Dashboards & Visualizations

Drilldown Time chart

pasokkum
Path Finder

I have a scheduled search which will run for every 5 hrs for the span of last 24 hrs.. When i drilldown that pie chart i need to pass the time to the new view.. If i pass last 24 hrs time to the view and if i am doing drilldown at 4th hour , it will fetch me the results for last 24 hrs from that particular time.. Hence there is difference in result count.. i need to pass the time when the search has run last time so that the result count will match..

Thanks..!

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

View solution in original post

sundareshr
Legend

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

pasokkum
Path Finder

Can u please give me an example of how to get the earliest time of a scheduled search in html view??

0 Karma

sundareshr
Legend

Like this

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <title>Earliest=$e$</title>
        <search ref="SavedReport">
          <done>
            <set token="e">$job.earliestTime$</set>
          </done>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

pasokkum
Path Finder

Thanks..! @sundareshr

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...