All Apps and Add-ons

TimeRangePicker timerange is not inherited by drilldown search

my2ndhead
SplunkTrust
SplunkTrust

I have a drilldown search which should inherit the timerange from the primary search.

The timepicker encloses both searches, including the drilldown search, and should therefore inhert the timerange.

<module name="TimeRangePicker" layoutPanel="panel_row2_col1"> 
    ...
      <module name="Search">
      ...
        <module name="SimpleResultsTable">
        ...
           <param name="drilldown">row</param>
             <module name="Search">
                ...
             </module>
          </module>
        </module>
      </module>
    </module>

The full view can be found here: pastebin.com

0 Karma
1 Solution

ziegfried
Influencer

The SimpleResultsTable module will use the _time field value for the timerange of the drilldown search since you're displaying it. A simple workaround is to create a new field with the timestamp value:

index=_internal $seriesToken$ | eval time=strftime(_time,"%m/%d/%y %I:%M:%S.%3N %p") | table time, series 

View solution in original post

ziegfried
Influencer

The SimpleResultsTable module will use the _time field value for the timerange of the drilldown search since you're displaying it. A simple workaround is to create a new field with the timestamp value:

index=_internal $seriesToken$ | eval time=strftime(_time,"%m/%d/%y %I:%M:%S.%3N %p") | table time, series 
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...