Dashboards & Visualizations

In a dashboard with a custom drilldown, how would I add 1ms to earliest=$click.value$ to get latest?

damucka
Builder

Hello,

In my dashboard, I need to define the custom drilldown where I would like to transport the _time, which is in the first column of my panel table. For that I need to have earliest and latest defined, where latest would be = earliest+1ms (at least that is how the Auto drilldown option gets it).

How would I do it?

My custom drilldown search looks as follows at the moment:

    index=mlbso sourcetype=*_transports source="*$sourcesid$*.$targetsid$" transport_exitcode=8 earliest=$click.value$ latest=???

Please adise.

Kind Regards,
Kamil

0 Karma
1 Solution

kmaron
Motivator

You should be able to do an eval to add the time.

 <drilldown>
           <eval token="latesttime">$click.value$+1ms</eval>
           <link>index=mlbso sourcetype=*_transports source="*$sourcesid$*.$targetsid$" transport_exitcode=8 earliest=$click.value$ latest=$latesttime$</link>
 </drilldown>

View solution in original post

0 Karma

kmaron
Motivator

You should be able to do an eval to add the time.

 <drilldown>
           <eval token="latesttime">$click.value$+1ms</eval>
           <link>index=mlbso sourcetype=*_transports source="*$sourcesid$*.$targetsid$" transport_exitcode=8 earliest=$click.value$ latest=$latesttime$</link>
 </drilldown>
0 Karma

damucka
Builder

Thank you.
It worked with

<eval token="latesttime">$click.value$+1ms</eval>
0 Karma

damucka
Builder

$click.value$+0.001

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...