Dashboards & Visualizations

How to drilldown time from a panel and use it to calculate the earliest and latest values to run other panels?

Arpit_S
Path Finder

The first panel in the dashboard is a table having Time as one field (this table is not a result of timechart command) and other fields.
I have configured a token to always pick the value of time field every time a row is clicked in the first panel. I checked, the token is being assigned the value of the time from the row being clicked, then I am using this value to calculate (-/+) 30 minutes which i'll be using as earliest and latest time for the other panels. The calculated values are showing the exact time but when using those values as earliest and latest in other panels, panels are running for a time range which is 9 hours earlier than the selected time.

Below is the drilldown section, (NOTE: Time is the left most field in the table that's why i have used $click.value$)

      <eval token="epochtime">strptime($click.value$, "%Y-%m-%d %H:%M:%S" )</eval>
      <eval token="earliesttok">epctime-1800</eval>
      <eval token="latesttok">epctime+1800</eval>

Has anyone run into some similar issue?

Please have a look and let me know.

Thanks.

Tags (2)
0 Karma
1 Solution

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

View solution in original post

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

arpit_1210
Explorer

Thanks @HiroshiSatoh, the solution you provided worked.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...