I am passing the timevalue and hostname from table 1 in panel1 to another query/panel in the same dashboard
Here is a sample time format : 2021-02-14 19:04:34
I first had the time as column 2 and tries all combinations of eval
<eval token>="e">strptime($click.value2$,"%Y-%m-%d %H:%M:%S.%3N")</eval>
<eval token="l">strptime($row._time$,"%Y-%m-%d %H:%M:%S.%3N")+1200</eval>
When I printed $e$ and $l$ said NaN
Then I made it column 1 and used this combination of eval
<eval token>="e">$click.value$-600</eval>
<eval token>="l">relative_time($click.value$,"+5m")</eval>
When I printed $e$ it said 1421 and $l$ said NaN
Ideas?
I seems to recall that $row._time$ is fiddly and I can't remember how to process it in tokens, but this is a simple solution that calculates the future time in the first result set, but just doesn't display it and then just use the value in the drilldown
<dashboard>
<label>Time</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval x=1
| eval f=_time+1200
| table _time x f</query>
<earliest>-15m@m</earliest>
<latest>@m</latest>
</search>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<fields>_time, x</fields>
<drilldown>
<set token="f">$row.f$</set>
</drilldown>
</table>
</panel>
<panel>
<table>
<search>
<query>
| makeresults
| eval f=$f$
| eval ft=strftime(f, "%F %T")
| table f ft
</query>
</search>
</table>
</panel>
</row>
</dashboard>
Hope this helps
I seems to recall that $row._time$ is fiddly and I can't remember how to process it in tokens, but this is a simple solution that calculates the future time in the first result set, but just doesn't display it and then just use the value in the drilldown
<dashboard>
<label>Time</label>
<row>
<panel>
<table>
<search>
<query>| makeresults
| eval x=1
| eval f=_time+1200
| table _time x f</query>
<earliest>-15m@m</earliest>
<latest>@m</latest>
</search>
<option name="drilldown">row</option>
<option name="refresh.display">progressbar</option>
<fields>_time, x</fields>
<drilldown>
<set token="f">$row.f$</set>
</drilldown>
</table>
</panel>
<panel>
<table>
<search>
<query>
| makeresults
| eval f=$f$
| eval ft=strftime(f, "%F %T")
| table f ft
</query>
</search>
</table>
</panel>
</row>
</dashboard>
Hope this helps