Dashboards & Visualizations

Why is the Time Selection not working when I click on a timeseries bar?

robertlynch2020
Influencer

Hi

The <Selection> in the bottom code is not working correctly and I can't figure out why.

I am looking to select the time when I click on a bar on the graph. To give me the time of the bar, however, it is always giving me the start time of the graph and not the zoomed-in time of the bar.

 

 <panel depends="$host_token$">
      <chart>
        <title>Sig Events Error Count by MX Component</title>
        <search>
          <query>| mstats max("mx.process.errors") prestats=true WHERE "index"="metrics_test" AND mx.env=$host_token$ AND log.type=sig-event span=60s BY "log.type" pid replica.name service.name | search "psrsvd_nx_mx.process.errors" &gt; 0
| rename "service.name" as service_name 
| rename "replica.name" as replica_name 
| eval Process_Name=((service_name . " # ") . replica_name) 
| timechart max("mx.process.errors") AS Error_Log_Nb by Process_Name limit=10000 
| eval Error_Log_Nb=substr(Error_Log_Nb, 1, len(Error_Log_Nb)-7)</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">column</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="refresh.display">progressbar</option>	
		 <selection>
          <set token="time_token_selection.earliest">$start$</set>
          <!--set token="time_token_selection.latest">$end$</set-->
		   <eval token="time_token_selection.latest">$time_token_selection.earliest$+5</eval>
		</selection>		
      </chart>
    </panel>

 

IN the below we can see i am click on the bar

robertlynch2020_0-1645552122723.png

However, the time in the tokens is the start and end, not the time on the bar that i have clicked on.

robertlynch2020_1-1645552158091.png

Regards

Robert 

Labels (3)
0 Karma
1 Solution

robertlynch2020
Influencer

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>

View solution in original post

0 Karma

robertlynch2020
Influencer

In the end, i had this all wrong - the code needs to be in the drill-down - like below.

 

 <panel depends="$host_token$">
      <title>Significant Events - Last 5m</title>
      <single>
        <search base="Basesearch_SIG_EVENTS">
          <query>
					 
					|  stats count as Errors
				</query>
        </search>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">76</option>
        <option name="rangeColors">["0x006d9c","0x006d9c"]</option>
        <option name="rangeValues">[0]</option>
        <option name="refresh.display">progressbar</option>
        <option name="unit">Sig Event(s)</option>
        <option name="useColors">1</option>
        <drilldown>
           <set token="time_token_selection.earliest">$earliest$</set>
			<set token="time_token_selection.latest">$latest$</set>
            <link target="_blank">http://splunk:8000/en-GB/app/$app_name$/$Dashboard_SIGNIFICANT_EVENTS$?host_token1=$host_token$&amp;URL_TRAP=SET&amp;Severity_token1=*&amp;form.time_token.earliest=$time_token_selection.earliest$&amp;form.time_token.latest=$time_token_selection.latest$&amp;Service_Name1=*</link>
    
        </drilldown>
      </single>
    </panel>
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...