All Apps and Add-ons
Highlighted

TimeRangePicker timerange is not inherited by drilldown search

SplunkTrust
SplunkTrust

I have a drilldown search which should inherit the timerange from the primary search.

The timepicker encloses both searches, including the drilldown search, and should therefore inhert the timerange.

<module name="TimeRangePicker" layoutPanel="panel_row2_col1"> 
    ...
      <module name="Search">
      ...
        <module name="SimpleResultsTable">
        ...
           <param name="drilldown">row</param>
             <module name="Search">
                ...
             </module>
          </module>
        </module>
      </module>
    </module>

The full view can be found here: pastebin.com

0 Karma
Highlighted

Re: TimeRangePicker timerange is not inherited by drilldown search

Influencer

The SimpleResultsTable module will use the _time field value for the timerange of the drilldown search since you're displaying it. A simple workaround is to create a new field with the timestamp value:

index=_internal $seriesToken$ | eval time=strftime(_time,"%m/%d/%y %I:%M:%S.%3N %p") | table time, series 

View solution in original post