Error with rounding the value in drilldown

[vikashperiwal]

Hi ,

I am trying to pass the value from one panel to drop down using drill down, issue i am getting is when using round function with eval.

<drilldown>
<set token="form.tok_status">$click.name2$</set>
<eval token="form.tok_time">round($click.value$,0)</eval> // when passing the token directly i am abe to                                                                                                                               get the value , but when using round its not working
</drilldown>

[niketn]

@vikashperiwal worked fine for me on Splunk 8.x which version are you trying and what error do you see?

I have tried two approach one through $click.value$ and other through $row._time$

        <drilldown>
          <eval token="form.tok_time">round($click.value$,0)</eval>
          <set token="clickedRowTime">$row._time$</set>
          <eval token="clickedRowTimeEpoch">round(strptime($row._time$,"%Y-%m-%dT%H:%M:%S.%3N%z"),0)</eval>
        </drilldown>

https://community.splunk.com/t5/Splunk-Search/Drilldown-pass-the-earliest-and-latest-from-a-timechar...

Following is the run anywhere example that I tried:

<form>
  <label>Table with drilldown</label>
  <fieldset submitButton="false">
    <input type="time" token="tokTime" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="tok_time">
      <label></label>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>tok_time: $tok_time$ | clickedRowTime: $clickedRowTime$ | clickedRowTimeEpoch: $clickedRowTimeEpoch$</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!=INFO
| timechart count as ERROR</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <!-- Convert string time format not epoch -->
        <!-- 2020-07-15T12:35:20.000+05:30 -->
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <eval token="form.tok_time">round($click.value$,0)</eval>
          <set token="clickedRowTime">$row._time$</set>
          <eval token="clickedRowTimeEpoch">round(strptime($row._time$,"%Y-%m-%dT%H:%M:%S.%3N%z"),0)</eval>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

[vikashperiwal]

Splunk v7.2

Strange thing is till yest it was wroking fine , and i did not do any change, by dont know why this stopped working.

Bascially  I have passed my dropdown token here i.e tok_time and from the table when i am sedning the date to the dropdown its vaue gets updated with the clicked field cell.. but i am not able to get the value in dropdown when using round

<eval token="form.tok_time">round($click.value$,0)</eval>

[niketn · Accepted solution]

Try with the following alternative as well.

          <eval token="clickedRowTimeEpoch">round(strptime($row._time$,"%Y-%m-%dT%H:%M:%S.%3N%z"),0)</eval>

If not raise Splunk Support ticket for the issue!