Hi guys,
I am having error while passing multiple tokens in drilldown of the XML
Here is my code:
demurrage test 1
<input type="time" token="time_tok1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
<input type="text" token="zone">
<label>zone</label>
</input>
<input type="text" token="location">
<label>location</label>
</input>
<panel>
<title>day wise discharge_qty</title>
<chart id="master">
<search>
<query>| inputlookup kv_logistics_demurrage | eval summarydateformat=round(strptime(date,"%m/%d/%Y"),0) | where (summarydateformat>"$time_tok1.earliest$" and summarydateformat<"$time_tok1.latest$") |stats count as vesselid by zone</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
<drilldown>
<set token="form.zone">$row.zone$</set>
</drilldown>
</chart>
</panel>
<panel>
<chart id="detail" depends="$zone$">
<title>Detail: $date$ material qty</title>
<search>
<query>| inputlookup kv_logistics_demurrage | eval summarydateformat=round(strptime(date,"%m/%d/%Y"),0) | where (summarydateformat>"$time_tok1.earliest$" and summarydateformat<"$time_tok1.latest$") |where zone="$zone$" | stats count as vesselid by location</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="charting.chart">column</option>
<drilldown>
<set token="from.location">$row.location$</set>
</drilldown>
</chart>
</panel>
<panel>
<chart id="detailed" depends="$locaion$">
<title>Detail: $sourcetype$</title>
<search>
<query>| inputlookup kv_logistics_demurrage | eval summarydateformat=round(strptime(date,"%m/%d/%Y"),0) | where (summarydateformat>"$time_tok1.earliest$" and summarydateformat<"$time_tok1.latest$") |where zone="$zone$" |where location="$location$"</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
</chart>
</panel>
Hi Venkataraman,
the problem is related to the format of summarydateformat, $time_tok1.earliest$ and $time_tok1.latest$:
the first is in "%m/%d/%Y" format, the other two, instead are in relative time format.
To compare them you need to have all epochtime formats.
In other words the first quesry will be something like this
| inputlookup kv_logistics_demurrage
| eval date=strptime(date,"%m/%d/%Y"), earliest=relative_time(now(),"$time_tok1.earliest$"), latest=relative_time(now(),"$time_tok1.latest$")
| where date>earliest AND date<latest
| stats count as vesselid by zone
Bye.
Giuseppe
I see "from.duration" which could be a typo (form.duration?) in line 42, and also "locaion" in line 47. Is this a typo in your question or in your original code?