All Apps and Add-ons

Splunk

prakashraja1999
Loves-to-Learn Everything

Details of the event Please tell me how to pass the time of the search result in "Link to search" on the dashboard. For events that include time in search results, such as the attached sample dashboard When searching using the "link to search" function, I would like to pass the time of the event as a parameter. Currently, earliest / latest is specified for SPL as shown in the sample. However, in this case, the time range picker when executing the search is not the earliest / latest specified by the parameter. The time range picker on the dashboard will be set. In the actual search, the earliest / latest specified in SPL is prioritized, so the result is as expected, but Since the range of the time range picker is different from the actual search result, users are confused. question 1 How can I pass the earliest / latest specified in SPL to the time range picker when executing a search? Question 2 In this sample, $ click.value $ is used because the time field is on the far left. Please tell me how to specify when passing the time field in any column. For reference, if you specify "$ row._time $", unlike the case of $ click.value $, it is not UNIX time. The displayed time has been set as a parameter.

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please include the sample dashboard you are referring to in a code block </>

0 Karma

prakashraja1999
Loves-to-Learn Everything

It is the query from client they does not provide any dashboard to me

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...