Dashboards & Visualizations

Problem with strptime drilldown token

3DGjos
Communicator

Hello, i'm developing a dashboard for a client, the thing is I need to pass an earliest and latest value to perform another search on another panel.

The panel needs the earliest and latest time of a transaction. then the panel 2 needs to search in the entire index between latest and earliest of the clicked transaction's row.

here is my XML:

panel 1

<query>| search   myswearch  | transaction myfield   maxevents=$maxevents$ keeporphans=true | eval t2=_time + duration | eval start=strftime(_time, "%d/%m/%y %H %M %S %3N"), finalization=strftime(t2, "%d/%m-%y %H:%M:%S:%3N")  | table start finalization duration myfields myfields </query>

<drilldown>

          <eval token="earliest">round(strptime($row.start$,"%d/%m/%y %H:%M:%S:%3N"),3)</eval>
          <eval token="latest">round(strptime($row.finalization$, "%d/%m/%y %H:%M:%S:%3N"),3)</eval>
        </drilldown>

and here is my panel2:

 <table depends="$mytoken$">
        <title>everything between $earliest$ and  $latest$</title>
        <search>
          <query>myindex | my table</query>
   <earliest>$earliest$</earliest>
    <latest>$latest$</latest>   

my problem is both tokens always evaluate to 946695600, and that's like 1/1/2000 hah.

thanks!

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...