Dashboards & Visualizations

Is their a way to preserve the time selected value from time range picker - drilldown

Builder

I have a view composed from a time range picker and a table.

I need to drilldown from one view to a target view but need to preserve the parameter selected from a time range picker , the target view will be displayed when clicking on a cell knowing that cells of the tables could be passed to the second view using the $click.value$ and i'm fine with that. How to preserve the value that is selected by the time range picker as earliest time?

( Last 30 Days --> -30d@d )
( Last 7 Days --> -7d@d )
etc...

Any idea?

1 Solution

SplunkTrust
SplunkTrust

All of the table and chart modules from Splunk and even the Table module from Sideview have the behavior where drilldowns will modify the timerange so that it gets turned into the absolute-equivalent timerange after a drilldown.

Thus a relative timerange of "-30d@d" will get freeze-dried into the fixed absolute timerange of " from 12:00:00 AM February 25 to 11:31:31 AM March 27, 2013". This happens regardless of whether _time is the primary field of the table or chart, or even if _time is involved in the search results at all.

So if you need to preserve the timerange (which might be relative or realtime), you have to stash it away somewhere safe. I get this question fairly often and the only way I know is to use the Sideview ValueSetter module.

<module name="TimeRangePicker"> 
  <param name="default">Last 30 days</param>
  <module name="ValueSetter">
    <param name="name">stashedEarliest</param>
    <param name="value">$search.timeRange.earliest$</param>
    <module name="ValueSetter">
      <param name="name">stashedLatest</param>
      <param name="value">$search.timeRange.latest$</param>

      ... now anywhere downstream from here you can use `$stashedEarliest$` and `$stashedLatest$`.

Thus $stashedEarliest$ and $stashedLatest$, downstream from that point, will always represent the time arguments as they came out of TimeRangePicker.

So you can use this in your Redirector module for instance to pass the value onto the next view after drilldown. Since how you pass timeRanges with Redirector is to pass them as explicit args anyway, it's trivial to pass this timerange instead of the normal altered one.

Even if you already have Sideview Utils, make sure it's up to date! There has been a very significant performance improvement in the most recent build and the pace of development is in general quite rapid so upgrade and get the benefit of fixes, improvements and features.

View solution in original post

SplunkTrust
SplunkTrust

All of the table and chart modules from Splunk and even the Table module from Sideview have the behavior where drilldowns will modify the timerange so that it gets turned into the absolute-equivalent timerange after a drilldown.

Thus a relative timerange of "-30d@d" will get freeze-dried into the fixed absolute timerange of " from 12:00:00 AM February 25 to 11:31:31 AM March 27, 2013". This happens regardless of whether _time is the primary field of the table or chart, or even if _time is involved in the search results at all.

So if you need to preserve the timerange (which might be relative or realtime), you have to stash it away somewhere safe. I get this question fairly often and the only way I know is to use the Sideview ValueSetter module.

<module name="TimeRangePicker"> 
  <param name="default">Last 30 days</param>
  <module name="ValueSetter">
    <param name="name">stashedEarliest</param>
    <param name="value">$search.timeRange.earliest$</param>
    <module name="ValueSetter">
      <param name="name">stashedLatest</param>
      <param name="value">$search.timeRange.latest$</param>

      ... now anywhere downstream from here you can use `$stashedEarliest$` and `$stashedLatest$`.

Thus $stashedEarliest$ and $stashedLatest$, downstream from that point, will always represent the time arguments as they came out of TimeRangePicker.

So you can use this in your Redirector module for instance to pass the value onto the next view after drilldown. Since how you pass timeRanges with Redirector is to pass them as explicit args anyway, it's trivial to pass this timerange instead of the normal altered one.

Even if you already have Sideview Utils, make sure it's up to date! There has been a very significant performance improvement in the most recent build and the pace of development is in general quite rapid so upgrade and get the benefit of fixes, improvements and features.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!