So I'm trying to do something basic, I searched but I couldn't find something that walked me through doing that.
I am collecting logs from F5 load balancer (proxy in a way). And I'm calculating the average delay over time per virtual server, I placed that in a dashboard panel.
So what I want is to create an interactive panel that automatically shows the average delay per URL at the specific time at the x-axis when the user clicks.
I did this but I'm not sure if thats correct.
And I created another panel, put a search and chose the "_time" in the earliest and latest time.
but I'm getting an error of the latest time can't be earlier than earliest time, I'm sure im doing something completely wrong but I'm no xml expert yet, if someone can let me know the simplest gui way to do this I'd be grateful.
Download the Splunk Dashboard Examples
app for many examples of similar drilldowns and copy the one that you like:
https://splunkbase.splunk.com/app/1603/