Dashboards & Visualizations

convert timeformat not responding in drilldown link search in simple xml

ssujin
Explorer

convert timeformat not responding with drilldown link tag, as a result drilldown search keep on showing loading. Sample simple xml below

<row>
    <panel name="Job Statistics">
        <table>
            <title>Job Statistics</title>
            <search>
                <query>index=$index$ host=$host$ eventtype=et_job_timing | eval Time=_time | convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)| table Time, THROUGHPUT | chart values(THROUGHPUT) by Time</query>
            </search>
            <option name="drilldown">cell</option>
            <drilldown>
                <link>search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time | convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)| table Time, THROUGHPUT | where Time = "$click.value$"</link>
            </drilldown>
        </table>
    </panel>
</row>

from above simple xml below mentioned search not responding.

search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time | convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)| table Time, THROUGHPUT | where Time = "$click.value$"

kindly guide me on this error.

0 Karma
1 Solution

HiroshiSatoh
Champion

convert command It looks like no good.
Workaround:
Macro the convert.

my_macro:convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)

search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time |‘my_macro‘| table Time, THROUGHPUT | where Time = "$click.value$"

View solution in original post

sundareshr
Legend

What are you trying to do? You cannot do an eval in link. Link requires a valid URL that will be launched. You can pass token values as querystring, but you will need to format them earlier. In short, what you have here will not work, but if you can explain what it is that you are trying to accomplish in your dashboard, we can help.

0 Karma

HiroshiSatoh
Champion

convert command It looks like no good.
Workaround:
Macro the convert.

my_macro:convert timeformat="%d-%m-%Y:%H:%M:%S" ctime(Time)

search?q=search index=$index$ host=$host$ eventtype=et_job_timing| eval Time=_time |‘my_macro‘| table Time, THROUGHPUT | where Time = "$click.value$"

ssujin
Explorer

Thanks lot. It worked perfectly.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...