Why is earliest not working on dashboard timepicke...

yhovakeemian_sp · ‎08-30-2019

Hi Splunkers,

I'm trying to get a dashboard timepicker to change on click to essentially zoom into the click value of a timechart + and - 60 mins. The below seems to be working just fine for the latest token, however, the earliest is doing nothing and it looks like it is reverting back to the original default on the dashboard.

<drilldown>
          <eval token="field2.earliest">relative_time($click.value$,"-60m")</eval>
          <eval token="field2.latest">relative_time($click.value$,"+60m")</eval>
        </drilldown>

field2 is my timepicker in the above.

Thanks in advance for the help.

DalJeanis · ‎09-05-2019

set a token and display it on the dash to see what $click.value$ is returning.

   <drilldown>
       <eval token="field2.earliest">relative_time($click.value$,"-60m")</eval>
       <eval token="field2.latest">relative_time($click.value$,"+60m")</eval>
       <eval token="displayClickValue">$click.value$</eval>
     </drilldown>

Then somewhere you can see it, put this panel

  <panel>
  <html>
  <p> Click Value is "$displayClickValue$" </p>
  </html>
 </panel>

niketnilay · ‎11-01-2019

@yhovakeemian_splunk seems strange but try using form. and validate that time input form variables are updated in the URL or not.

    <drilldown>
      <eval token="form.field2.earliest">relative_time($click.value$,"-60m")</eval>
      <eval token="form.field2.latest">relative_time($click.value$,"+60m")</eval>
    </drilldown>

Also, for the community to assist you better please provide your current SPL which generates the time series for the table.

| eval message="Happy Splunking!!!"

Why is earliest not working on dashboard timepicker token on click.value?

Re: Why is earliest not working on dashboard timepicker token on click.value?

Re: Why is earliest not working on dashboard timepicker token on click.value?