I have two source , like source1 and source2 .
source1 has fields like, event, id, source1_total_time
source2 has fields like, id, source2_total_time
I am working on dashboard where first panel query is like ,
source=source1 | stats count min(source1_total_time) as min_response_time,max(v) as max_response_time,avg(source1_total_time) as avg_response_time,perc95(source1_total_time) as perc95_response_time,range(source1_total_time) as range by EVENT
| eval minimum=round(min_response_time, 0)." ms"
| eval average=round(avg_response_time, 0)." ms"
| eval maximum=round(max_response_time, 0)." ms"
| eval perc95=round(perc95_response_time, 0)." ms"
| eval range=round(min_response_time, 0)." - ".round(min_response_time+range, 0)." ms"
| sort - perc95_response_time
| fields - *_time
I am building second panel using event as drill down token as below,
<set token="eventid">$row.EVENT$</set>
</drilldown>
My second panel query is like ,
source=source1 EVENT="$eventid$" | join type=inner id [ search source=source2 ] | eval TOTAL_TIME_TAKEN = tostring((source1_total_time - source2_total_time), "duration") | table EVENT ID source1_total_time, source2_total_time TOTAL_TIME_TAKEN _time
I am not getting the desired result with this. Here Expected is that, if the first panel gives 10 events count, when we click on that count second panel has to give me details about all that events with unique ids, event, the total time taken.
Could you please help me with this.
Thanks,
