Dashboards & Visualizations

How to drilldown time from a panel and use it to calculate the earliest and latest values to run other panels?

Arpit_S
Path Finder

The first panel in the dashboard is a table having Time as one field (this table is not a result of timechart command) and other fields.
I have configured a token to always pick the value of time field every time a row is clicked in the first panel. I checked, the token is being assigned the value of the time from the row being clicked, then I am using this value to calculate (-/+) 30 minutes which i'll be using as earliest and latest time for the other panels. The calculated values are showing the exact time but when using those values as earliest and latest in other panels, panels are running for a time range which is 9 hours earlier than the selected time.

Below is the drilldown section, (NOTE: Time is the left most field in the table that's why i have used $click.value$)

      <eval token="epochtime">strptime($click.value$, "%Y-%m-%d %H:%M:%S" )</eval>
      <eval token="earliesttok">epctime-1800</eval>
      <eval token="latesttok">epctime+1800</eval>

Has anyone run into some similar issue?

Please have a look and let me know.

Thanks.

Tags (2)
0 Karma
1 Solution

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

View solution in original post

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

arpit_1210
Explorer

Thanks @HiroshiSatoh, the solution you provided worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...