How to pass time range values in a drilldown?

[sushmitha_mj]

Hi,

I am having trouble passing a time range value from the main form to the drilldown form . So when I click on each row i want the drill to show the transactions in that time range alone(15 min in this case)

Here is my main form query and drill down link

   <search>
      <query>index=ibd Service_Name=*|timechart span=15m count(Trans)   | eval _earliest = _time | eval _latest = _time + _span</query>
      <earliest>$TimeField.earliest$</earliest>
      <latest>$TimeField.latest$</latest>
    </search>

   <drilldown>
      <link>
        <![CDATA[/app/app_name/form_name?form._earliest=$row._earliest$&form._latest=$row._latest$]]>
        <option name="dataOverlayMode">none</option>
      </link>
    </drilldown>

On the drill down dashboard I have the following:

<input type="time" searchWhenChanged="true" token="TimeField">
  <label></label>
  <default>
    <earliest>$_earliest$</earliest>
     <latest>$_latest$</latest>
    </default>
</input>

To pass the value to the query, I simply used:

      <query>...|search </query>
      <earliest>$TimeField.earliest$</earliest>
      <latest>$TimeField.latest$</latest>

Since this did not work... I tried to pass the time value directly:

      <query>...|search </query>
      <earliest>$_earliest$</earliest>
      <latest>$_latest$</latest>

Both did not work. Can someone tell me what is wrong:

[sundareshr · Accepted solution]

Try this

*Main Dashboard*

<search>
       <query>index=ibd Service_Name=*| timechart span=15m count(Trans) </query>
       <earliest>$TimeField.earliest$</earliest>
       <latest>$TimeField.latest$</latest>
     </search>
    <drilldown>
       <eval token="e">$click.value$</eval>
       <eval token="le">relative_time($click.value$, "+15m")</eval>
       <link>
         <![CDATA[/app/app_name/form_name?form._earliest=$e$&form._latest=$l$]]>
         <option name="dataOverlayMode">none</option>
       </link>
     </drilldown>

**** On drilldown dashboard****

 <input type="time" searchWhenChanged="true" token="TimeField">
   <label></label>
   <default>
     <earliest>$form._earliest$</earliest>
      <latest>$form._latest$</latest>
     </default>
 </input>

[james_n]

hi @sundareshr , Its working fine for last 24 hours or Today, But if i select last 7 days its taking earliest as day starting and latest as day starting to 15 minutes like 00:15:00, Could you help on this.

[sushmitha_mj]

It worked!! Awesome thanks