How to make timeline drilldown time parameters?

michaeler — Wed, 10 May 2023 15:02:52 GMT

I'm trying to do a drilldown of a timechart where the Y-axis field is Domain and the value is a count, X-axis is time by Day. I've done this successfully with other visualizations but am having trouble passing the time on the x-axis into my new search. Everything seems to be working but every time it's run, I get "No results found"

index=main sourcetype=mysourcetype | eval start=$dd_earliest$ | eval end=start+86399 | eval earliest=strftime(start, "%m/%d/%Y%H:%M:%S"), latest=strftime(end, "%m/%d/%Y%H:%M:%S") | search Domain=$selected_domain$ earliest=earliest latest=latest | rest of search.....

Here's what I have for the search it's drilldowned from:

<drilldown>
<set token="selected_domain">$click.name2$</set>
<set token="dd_earliest">$click.value$</set>

The values all pass though correctly but there is something wrong with my earliest and latest in my search. I've tried using the start and end values instead, surrounding them in quotes, and a few other things but to no avail.

Re: Timeline drilldown time parameters

richgalloway — Tue, 09 May 2023 20:34:14 GMT

Try using starttime and endtime with strings as values.

index=main sourcetype=mysourcetype | eval start=$dd_earliest$ | eval end=start+86399 | eval earliest="\"".strftime(start, "%m/%d/%Y:%H:%M:%S")."\"", latest="\".strftime(end, "%m/%d/%Y:%H:%M:%S")."\"" | search Domain=$selected_domain$ starttime=earliest endtime=latest | rest of search.....

topic How to make timeline drilldown time parameters? in Splunk Search

How to make timeline drilldown time parameters?

Re: Timeline drilldown time parameters