Dashboards & Visualizations

Why is earliest not working on dashboard timepicker token on click.value?

yhovakeemian_sp
Splunk Employee
Splunk Employee

Hi Splunkers,

I'm trying to get a dashboard timepicker to change on click to essentially zoom into the click value of a timechart + and - 60 mins. The below seems to be working just fine for the latest token, however, the earliest is doing nothing and it looks like it is reverting back to the original default on the dashboard.

<drilldown>
          <eval token="field2.earliest">relative_time($click.value$,"-60m")</eval>
          <eval token="field2.latest">relative_time($click.value$,"+60m")</eval>
        </drilldown>

field2 is my timepicker in the above.

Thanks in advance for the help.

niketn
Legend

@yhovakeemian_splunk seems strange but try using form. and validate that time input form variables are updated in the URL or not.

    <drilldown>
      <eval token="form.field2.earliest">relative_time($click.value$,"-60m")</eval>
      <eval token="form.field2.latest">relative_time($click.value$,"+60m")</eval>
    </drilldown>

Also, for the community to assist you better please provide your current SPL which generates the time series for the table.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DalJeanis
Legend

set a token and display it on the dash to see what $click.value$ is returning.

   <drilldown>
       <eval token="field2.earliest">relative_time($click.value$,"-60m")</eval>
       <eval token="field2.latest">relative_time($click.value$,"+60m")</eval>
       <eval token="displayClickValue">$click.value$</eval>
     </drilldown>

Then somewhere you can see it, put this panel

  <panel>
  <html>
  <p> Click Value is "$displayClickValue$" </p>
  </html>
 </panel>
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...