Dashboards & Visualizations

How to drilldown time from a panel and use it to calculate the earliest and latest values to run other panels?

Arpit_S
Path Finder

The first panel in the dashboard is a table having Time as one field (this table is not a result of timechart command) and other fields.
I have configured a token to always pick the value of time field every time a row is clicked in the first panel. I checked, the token is being assigned the value of the time from the row being clicked, then I am using this value to calculate (-/+) 30 minutes which i'll be using as earliest and latest time for the other panels. The calculated values are showing the exact time but when using those values as earliest and latest in other panels, panels are running for a time range which is 9 hours earlier than the selected time.

Below is the drilldown section, (NOTE: Time is the left most field in the table that's why i have used $click.value$)

      <eval token="epochtime">strptime($click.value$, "%Y-%m-%d %H:%M:%S" )</eval>
      <eval token="earliesttok">epctime-1800</eval>
      <eval token="latesttok">epctime+1800</eval>

Has anyone run into some similar issue?

Please have a look and let me know.

Thanks.

Tags (2)
0 Karma
1 Solution

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

View solution in original post

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

arpit_1210
Explorer

Thanks @HiroshiSatoh, the solution you provided worked.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...