Hi,
I am having trouble passing a time range value from the main form to the drilldown form . So when I click on each row i want the drill to show the transactions in that time range alone(15 min in this case)
Here is my main form query and drill down link
<search>
<query>index=ibd Service_Name=*|timechart span=15m count(Trans) | eval _earliest = _time | eval _latest = _time + _span</query>
<earliest>$TimeField.earliest$</earliest>
<latest>$TimeField.latest$</latest>
</search>
<drilldown>
<link>
<![CDATA[/app/app_name/form_name?form._earliest=$row._earliest$&form._latest=$row._latest$]]>
<option name="dataOverlayMode">none</option>
</link>
</drilldown>
On the drill down dashboard I have the following:
<input type="time" searchWhenChanged="true" token="TimeField">
<label></label>
<default>
<earliest>$_earliest$</earliest>
<latest>$_latest$</latest>
</default>
</input>
To pass the value to the query, I simply used:
<query>...|search </query>
<earliest>$TimeField.earliest$</earliest>
<latest>$TimeField.latest$</latest>
Since this did not work... I tried to pass the time value directly:
<query>...|search </query>
<earliest>$_earliest$</earliest>
<latest>$_latest$</latest>
Both did not work. Can someone tell me what is wrong:
Try this
*Main Dashboard*
<search>
<query>index=ibd Service_Name=*| timechart span=15m count(Trans) </query>
<earliest>$TimeField.earliest$</earliest>
<latest>$TimeField.latest$</latest>
</search>
<drilldown>
<eval token="e">$click.value$</eval>
<eval token="le">relative_time($click.value$, "+15m")</eval>
<link>
<![CDATA[/app/app_name/form_name?form._earliest=$e$&form._latest=$l$]]>
<option name="dataOverlayMode">none</option>
</link>
</drilldown>
**** On drilldown dashboard****
<input type="time" searchWhenChanged="true" token="TimeField">
<label></label>
<default>
<earliest>$form._earliest$</earliest>
<latest>$form._latest$</latest>
</default>
</input>
Try this
*Main Dashboard*
<search>
<query>index=ibd Service_Name=*| timechart span=15m count(Trans) </query>
<earliest>$TimeField.earliest$</earliest>
<latest>$TimeField.latest$</latest>
</search>
<drilldown>
<eval token="e">$click.value$</eval>
<eval token="le">relative_time($click.value$, "+15m")</eval>
<link>
<![CDATA[/app/app_name/form_name?form._earliest=$e$&form._latest=$l$]]>
<option name="dataOverlayMode">none</option>
</link>
</drilldown>
**** On drilldown dashboard****
<input type="time" searchWhenChanged="true" token="TimeField">
<label></label>
<default>
<earliest>$form._earliest$</earliest>
<latest>$form._latest$</latest>
</default>
</input>
hi @sundareshr , Its working fine for last 24 hours or Today, But if i select last 7 days its taking earliest as day starting and latest as day starting to 15 minutes like 00:15:00, Could you help on this.
It worked!! Awesome thanks