Dashboards & Visualizations

Drilldown with dynamic relative_time

Micke
Observer

I am trying to drilldown within a dashboard. I wish set a token-value with relative_time, using a dynamic relative time specifier input-variable.

If I set the relative time specifier to "+1h" it works fine: <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>

But when I use a token with value "1h" it does not: <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>

I paste my complete code as reference:

 

 

<form>
<label>Drilldown-lab</label>
<fieldset submitButton="false">
    <input type="time" token="period_token">
      <label>Period</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>@h</latest>
      </default>
    </input>
    <input type="dropdown" token="resolution_token">
      <label>Resolution</label>
      <choice value="15m">15 minutes</choice>
      <choice value="1h">1 hour</choice>
      <default>1h</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Overview-panel</title>
      <table>
        <search>
          <query>
            index="my_index"
            | bin _time span=$resolution_token$
            | eval startTime = strftime(_time, "%Y-%m-%d %H:%M")
            | stats count by startTime
            </query>
          <earliest>$period_token.earliest$</earliest>
          <latest>$period_token.latest$</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <eval token="startTime_token">strptime($row.startTime$, "%Y-%m-%d %H:%M")</eval>
          <eval token="endTime_token">relative_time($startTime_token$, "+1h")</eval>
          <eval token="endTime_token2">relative_time($startTime_token$, "+$resultion_token$"</eval>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$startTime_token$">
      <title>Drilldown-panel $endTime_token$, $endTime_token2$</title>
      <table>
        <search>
          <query>
            index="my_index"
            | stats avg(responseTimeMs) as Responsetime_avg count by assetId
          </query>
          <earliest>$startTime_token$</earliest>
          <latest>$endTime_token$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

 

 

 

 I am able to calculate the endTime-value in my query (SPL), I would prefer to be able to set it with "eval token".

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Apart from fixing the typo, try this

<eval token="endTime_token2">relative_time($startTime_token$, "+".$resolution_token$</eval>
0 Karma

Micke
Observer

Works perfect, thank you (and also for pointing out the typo)!

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...