Dashboards & Visualizations

How to drilldown time from a panel and use it to calculate the earliest and latest values to run other panels?

Arpit_S
Path Finder

The first panel in the dashboard is a table having Time as one field (this table is not a result of timechart command) and other fields.
I have configured a token to always pick the value of time field every time a row is clicked in the first panel. I checked, the token is being assigned the value of the time from the row being clicked, then I am using this value to calculate (-/+) 30 minutes which i'll be using as earliest and latest time for the other panels. The calculated values are showing the exact time but when using those values as earliest and latest in other panels, panels are running for a time range which is 9 hours earlier than the selected time.

Below is the drilldown section, (NOTE: Time is the left most field in the table that's why i have used $click.value$)

      <eval token="epochtime">strptime($click.value$, "%Y-%m-%d %H:%M:%S" )</eval>
      <eval token="earliesttok">epctime-1800</eval>
      <eval token="latesttok">epctime+1800</eval>

Has anyone run into some similar issue?

Please have a look and let me know.

Thanks.

Tags (2)
0 Karma
1 Solution

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

View solution in original post

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

arpit_1210
Explorer

Thanks @HiroshiSatoh, the solution you provided worked.

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...