Latest time turns to now in customised search drill down

[saravana22]

Hi Guys,

Am new to splunk. i have table as below and setup the drill from the table to search with customised string.

As expected earlisted date picking the exact date of the row but latest is not captures and becomes today date.

Can any one help on this one please

Result:

_time                      P01  P02  P03  P04
2021-08-29           2       4      3       0
2021-09-03           4       0      1       3

Source of my drilldown

<drilldown><set token="form.host1">"$click.name2$"</set>
<eval token="earliest">strftime($click.value$, "%Y/%m/%d %T")</eval>
<eval token="latest">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval>
<link target="_blank">search?q=index=prod_s3%20%20host=p01%20OR%20host=p02%20OR%20host=p03%20OR%20host=p04%20
sourcetype=%22WinEventLog:System%22%20EventCode=%2219%22%20%0D%0A%7Csearch%20host%20=%20$form.host1$%0D%0A%7Crex%20field=_raw%20%22.*%5C((%3F%3CKB%3E%5Cw*)
%5C)%22%0D%0A%7Ceval%20t=strftime(_time,%20%22%25Y/%25m/%25d%20%25T%22)%0D%0A%7Cbin%20_time%20span=1d%0D%0A%7Ctable%20_time%20host%20ComputerName%20KB&amp;
earliest=$click.value$&amp;latest=$latest$</link></drilldown>

If i use <condition field ="_time" then earliest and latest captures the row time nicely but customised search string is not coming up 😞

[richgalloway · Accepted solution]

It is not necessary to parse _time as it is already in epoch form.  In the eval for token=latest, the strptime function is returning NULL so the token is not set.

[saravana22]

Even i have changed the source and search string as below, getting an error "Invalid latest_time: latest_time must be after earliest_time." Please help me on this. thanks

<drilldown>

<eval token="earliest1">strftime($click.value$, "%Y/%m/%d %T")</eval>
<set token="latest1">$row.l$</set>
<set token="form.host1">"$click.name2$"</set>
<link target="_blank">search?q=index=prod_s3%20host=p01%20OR%20host=p02%20OR%20host=p03%20OR%20host=p040%20sourcetype=%22WinEventLog:System%22%20EventCode=%2219%22%0A%7Csearch%20host%20=%20$form.host1$%0A%7Crex%20field=_raw%20%22.*%5C((%3F%3CKB%3E%5Cw*)%5C)%22%0A%7Ceval%20l=relative_time(_time,%22%2B86400s%22)%0A%7Ctable%20_time%20l%20host%20ComputerName%20KB&amp;earliest=$click.value$&amp;latest=$latest1$</link>
</drilldown>

search string:

index=prod_s3 host=p03p6p0w9481 OR host=p03p6p0w3524 OR host=p03p6p0w7018 OR host=p03p6p0w5650 sourcetype="WinEventLog:System" EventCode="19"
|search host = $form.host1
|rex field=_raw ".*\((?<KB>\w*)\)"
|eval l=relative_time(_time,"+86400s")
|table _time l host ComputerName KB

[richgalloway]

When you click to drill down, the URL of the drilldown tab should show the values of earliest and latest.  Verify the former is smaller than the latter.  Share if you need help.