Dashboards & Visualizations

Drilldown Time chart

Path Finder

I have a scheduled search which will run for every 5 hrs for the span of last 24 hrs.. When i drilldown that pie chart i need to pass the time to the new view.. If i pass last 24 hrs time to the view and if i am doing drilldown at 4th hour , it will fetch me the results for last 24 hrs from that particular time.. Hence there is difference in result count.. i need to pass the time when the search has run last time so that the result count will match..

Thanks..!

Tags (2)
0 Karma
1 Solution

Legend

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

View solution in original post

Legend

See if these tokens give you what you're looking for

$job.earliestTime$: Job start time.
$job.latestTime$: Latest time recorded for the search job.

http://docs.splunk.com/Documentation/Splunk/6.4.3/Viz/tokens#Search_event_elements_and_job_propertie...

View solution in original post

Path Finder

Can u please give me an example of how to get the earliest time of a scheduled search in html view??

0 Karma

Legend

Like this

<dashboard>
  <label>test</label>
  <row>
    <panel>
      <table>
        <title>Earliest=$e$</title>
        <search ref="SavedReport">
          <done>
            <set token="e">$job.earliestTime$</set>
          </done>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="drilldown">cell</option>
        <option name="dataOverlayMode">none</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>
0 Karma

Path Finder

Thanks..! @sundareshr

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!