Dashboards & Visualizations

Drilldown Time chart

pasokkum
Path Finder

I have a scheduled search which will run for every 5 hrs for the span of last 24 hrs.. When i drilldown that pie chart i need to pass the time to the new view.. If i pass last 24 hrs time to the view and if i am doing drilldown at 4th hour , it will fetch me the results for last 24 hrs from that particular time.. Hence there is difference in result count.. i need to pass the time when the search has run last time so that the result count will match..

Thanks..!

Tags (2)
0 Karma
1 Solution

sundareshr
Legend

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

View solution in original post

sundareshr
Legend

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

pasokkum
Path Finder

Can u please give me an example of how to get the earliest time of a scheduled search in html view??

0 Karma

sundareshr
Legend

Like this

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <title>Earliest=$e$</title>
        <search ref="SavedReport">
          <done>
            <set token="e">$job.earliestTime$</set>
          </done>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

pasokkum
Path Finder

Thanks..! @sundareshr

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...