I'm trying to do a drilldown in simple XML that uses a link like this:
/app/appname/formname?form.token=Sitename
When the new chart launches, the search is running against all time and the URL has "earliest=0" in part of the URL, after the #:
Even if I specify "earliest=$earliest$&latest=$latest$" in the link from the original report, I see the correct times for earliest and latest before the # in the drilldown form URL, but I end up with "earliest=0" after the #, and the search defaults to "All Time". What am I missing?
thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.
thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.
I have lately tried this again with my drilldown and I'm still getting the same result. I'm currently on splunk 6.0.3
I've done the same thing on my drilldown and I'm getting the same result and I'm on splunk 5.0.5