Dashboards & Visualizations

Problem with strptime drilldown token

3DGjos
Communicator

Hello, i'm developing a dashboard for a client, the thing is I need to pass an earliest and latest value to perform another search on another panel.

The panel needs the earliest and latest time of a transaction. then the panel 2 needs to search in the entire index between latest and earliest of the clicked transaction's row.

here is my XML:

panel 1

<query>| search   myswearch  | transaction myfield   maxevents=$maxevents$ keeporphans=true | eval t2=_time + duration | eval start=strftime(_time, "%d/%m/%y %H %M %S %3N"), finalization=strftime(t2, "%d/%m-%y %H:%M:%S:%3N")  | table start finalization duration myfields myfields </query>

<drilldown>

          <eval token="earliest">round(strptime($row.start$,"%d/%m/%y %H:%M:%S:%3N"),3)</eval>
          <eval token="latest">round(strptime($row.finalization$, "%d/%m/%y %H:%M:%S:%3N"),3)</eval>
        </drilldown>

and here is my panel2:

 <table depends="$mytoken$">
        <title>everything between $earliest$ and  $latest$</title>
        <search>
          <query>myindex | my table</query>
   <earliest>$earliest$</earliest>
    <latest>$latest$</latest>   

my problem is both tokens always evaluate to 946695600, and that's like 1/1/2000 hah.

thanks!

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...