Dashboards & Visualizations

Dynamic drilldown in column chart to store earliest and latest time in a token

dorlevy88
Engager

When trying to drill down from a column chart to a different, I want to get the earliest and latest time of the column itself and store it in a token.

    <drilldown>
      <set token="drillTimeEarly">$earliest$</set>
      <set token="drillTimeLatest">$latest$</set>
    </drilldown>

In the past i was able to get the appropriate time of the column i clicked on, but now I get the earliest/latest of the search itself.

Does anyone have any idea why it happens?

the search string is - host="DV-LB01" | bucket _time span=$span$ | chart count by _time

Any help will be helpful.

Thanks,
Dor Levy

Tags (2)
1 Solution

dorlevy88
Engager

Fixed - The only way to get a bar ealiest and latest is if it is a timechart.

changed the search from -
host="DV-LB01" | bucket _time span=$span$ | chart count by _time

to-
host="DV-LB01" | timechart span=$span$ count

Hope it helps,
Dor Levy

View solution in original post

dorlevy88
Engager

Fixed - The only way to get a bar ealiest and latest is if it is a timechart.

changed the search from -
host="DV-LB01" | bucket _time span=$span$ | chart count by _time

to-
host="DV-LB01" | timechart span=$span$ count

Hope it helps,
Dor Levy

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...