Dashboards & Visualizations

Dynamic drilldown in column chart to store earliest and latest time in a token

dorlevy88
Engager

When trying to drill down from a column chart to a different, I want to get the earliest and latest time of the column itself and store it in a token.

    <drilldown>
      <set token="drillTimeEarly">$earliest$</set>
      <set token="drillTimeLatest">$latest$</set>
    </drilldown>

In the past i was able to get the appropriate time of the column i clicked on, but now I get the earliest/latest of the search itself.

Does anyone have any idea why it happens?

the search string is - host="DV-LB01" | bucket _time span=$span$ | chart count by _time

Any help will be helpful.

Thanks,
Dor Levy

Tags (2)
1 Solution

dorlevy88
Engager

Fixed - The only way to get a bar ealiest and latest is if it is a timechart.

changed the search from -
host="DV-LB01" | bucket _time span=$span$ | chart count by _time

to-
host="DV-LB01" | timechart span=$span$ count

Hope it helps,
Dor Levy

View solution in original post

dorlevy88
Engager

Fixed - The only way to get a bar ealiest and latest is if it is a timechart.

changed the search from -
host="DV-LB01" | bucket _time span=$span$ | chart count by _time

to-
host="DV-LB01" | timechart span=$span$ count

Hope it helps,
Dor Levy

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...