All Apps and Add-ons

Splunk

prakashraja1999
Loves-to-Learn Everything

Details of the event Please tell me how to pass the time of the search result in "Link to search" on the dashboard. For events that include time in search results, such as the attached sample dashboard When searching using the "link to search" function, I would like to pass the time of the event as a parameter. Currently, earliest / latest is specified for SPL as shown in the sample. However, in this case, the time range picker when executing the search is not the earliest / latest specified by the parameter. The time range picker on the dashboard will be set. In the actual search, the earliest / latest specified in SPL is prioritized, so the result is as expected, but Since the range of the time range picker is different from the actual search result, users are confused. question 1 How can I pass the earliest / latest specified in SPL to the time range picker when executing a search? Question 2 In this sample, $ click.value $ is used because the time field is on the far left. Please tell me how to specify when passing the time field in any column. For reference, if you specify "$ row._time $", unlike the case of $ click.value $, it is not UNIX time. The displayed time has been set as a parameter.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please include the sample dashboard you are referring to in a code block </>

0 Karma

prakashraja1999
Loves-to-Learn Everything

It is the query from client they does not provide any dashboard to me

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...