Hi,
In my dashboards I use custom drilldown:
<drilldown>
<set token="clicked_earliest_date">$earliest$</set>
<eval token="clicked_latest_date">$clicked_earliest_date$+86400</eval>
<link target="_self">search?q=my_query
| eval Time=_time
| convert timeformat="%Y-%m-%d" ctime(Time)
&earliest=$clicked_earliest_date$&latest=$clicked_latest_date$</link>
</drilldown>
This drilldown used to work but I noticed that there are times it does not work.
1. if I use convert timeformat="%Y-%m-%d" ctime(Time), when drilling down I get an empty search window but I can notice that the URL of this page contains the query.
2. If I remove convert timeformat="%Y-%m-%d" ctime(Time), I get non-empty search window but I also see that time range is different than the time of the clicked event.
I must say again that this drill down sometimes works and sometimes doesn't.
Someone is familiar with this issue?
try wrapping code in CDATA-
have a look at recent post-
https://answers.splunk.com/answers/690132/in-a-dashboard-why-cant-i-configure-a-drill-down-w-1.html#...
or simply relace % by %25 for url encoding-
<drilldown>
<link target="_self">search?q=index=_internal | eval Time=_time| convert timeformat="%25Y-%25m-%25d" ctime(Time)&earliest=-15m&latest=now</link>
</drilldown>
@493669
Unfortunately it does not work. same problem.
@shayhibah ,
simply relace %
by %25
for url encoding-
<drilldown>
<link target="_self">search?q=index=_internal | eval Time=_time| convert timeformat="%25Y-%25m-%25d" ctime(Time)&earliest=-15m&latest=now</link>
</drilldown>
@493669
Thanks for your reply.
Your proposal semi-helped - it now shows the search window but the time range is still wrong and therefore I don't get results.
The time range is based on the tokens I defined ans for some reason is does not related to them.
i tried one sample example and it is working ..
<form>
<label>drilldown_690132</label>
<fieldset submitButton="false">
<input type="time" token="timec">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=_internal | head 10 | stats count by source</query>
<earliest>-15m</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<link target="_self">search?q=index=_internal | eval Time=_time| convert timeformat="%25Y-%25m-%25d" ctime(Time)&earliest=$timec.earliest$&latest=$timec.latest$</link>
</drilldown>
</table>
</panel>
</row>
</form>