Dashboards & Visualizations

Dynamic drilldown in column chart to store earliest and latest time in a token

dorlevy88
Engager

When trying to drill down from a column chart to a different, I want to get the earliest and latest time of the column itself and store it in a token.

    <drilldown>
      <set token="drillTimeEarly">$earliest$</set>
      <set token="drillTimeLatest">$latest$</set>
    </drilldown>

In the past i was able to get the appropriate time of the column i clicked on, but now I get the earliest/latest of the search itself.

Does anyone have any idea why it happens?

the search string is - host="DV-LB01" | bucket _time span=$span$ | chart count by _time

Any help will be helpful.

Thanks,
Dor Levy

Tags (2)
1 Solution

dorlevy88
Engager

Fixed - The only way to get a bar ealiest and latest is if it is a timechart.

changed the search from -
host="DV-LB01" | bucket _time span=$span$ | chart count by _time

to-
host="DV-LB01" | timechart span=$span$ count

Hope it helps,
Dor Levy

View solution in original post

dorlevy88
Engager

Fixed - The only way to get a bar ealiest and latest is if it is a timechart.

changed the search from -
host="DV-LB01" | bucket _time span=$span$ | chart count by _time

to-
host="DV-LB01" | timechart span=$span$ count

Hope it helps,
Dor Levy

Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...