Drilldown Time chart

[pasokkum]

I have a scheduled search which will run for every 5 hrs for the span of last 24 hrs.. When i drilldown that pie chart i need to pass the time to the new view.. If i pass last 24 hrs time to the view and if i am doing drilldown at 4th hour , it will fetch me the results for last 24 hrs from that particular time.. Hence there is difference in result count.. i need to pass the time when the search has run last time so that the result count will match..

Thanks..!

[sundareshr · Accepted solution]

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

[pasokkum]

Can u please give me an example of how to get the earliest time of a scheduled search in html view??

[sundareshr]

Like this

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <title>Earliest=$e$</title>
        <search ref="SavedReport">
          <done>
            <set token="e">$job.earliestTime$</set>
          </done>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>

[pasokkum]

Thanks..! @sundareshr