strptime drilldown token not working

[3DGjos]

Hello, Im working on a dashboard for a client. I need to drilldown the earliest and latest time of my transaction's events. But still can't do it. The value has to go from a table to another.

here is my table1:

   <search>
          <query>mysearch  | transaction myfield | eval t2=_time + duration | eval start=strftime(_time, "%d/%m/%y %H:%M:%S:%3N"), finalization=strftime(t2, "%d/%m/%y %H:%M:%S:%3N")  | table finalization start duration myfields</query>
        </search>
          <drilldown>
          <eval token="earliest">round(strptime($row.start$,"%d/%m/%y %H:%M:%S:%3N"),3)</eval>
          <eval token="latest">round(strptime($row.finalization$, "%d/%m/%y %H:%M:%S:%3N"),3)</eval>
</drilldown>

and here is my table2:

    <table depends="$muhtoken$">
        <title>all events between $earliest$ and $latest$</title>
        <search>
          <query>mysearch | mytable</query>
    <earliest>$earliest$</earliest>
          <latest>$latest$</latest>        
</search>

      </table>

the problem is both token values are 946695600 (1/1/2000), tried the round, but still. same value.

thanks!
P.s: version is 6.3.1

[jpolvino]

One technique that may work for you is to include the native time values in your top query, but hide them from the user.

<search>
   <query>mysearch | transaction myfield | eval t2=_time + duration | eval start=strftime(_time, "%d/%m/%y %H:%M:%S:%3N"), finalization=strftime(t2, "%d/%m/%y %H:%M:%S:%3N") | rename start AS StartTime t2 AS EndTime | table finalization start duration myfields StartTime EndTime
   </query>
</search>
<option name=drilldown">row</option>
<fields>finalization start duration myfields</fields>
<drilldown>
   <eval token="StartTime">$row.StartTime$</eval>
   <eval token="forms.StartTime">$row.StartTime$</eval>
   <eval token="EndTime">$row.EndTime$</eval>
   <eval token="forms.EndTime">$row.EndTime$</eval>
 </drilldown>

Then you can use $StartTime$ and $EndTime$ in the receiving panel.

I'd also suggest you comment out the fields line to have the times printed in the stats table, and confirm their accuracy. Avoid using reserved words like earliest and latest.

[jeffland]

For me, the following works fine on 7.2 and I don't see why it wouldn't work on 6.3:

<panel>
  <title>final is $finalization$</title>
  <table>
    <search>
      <query>| makeresults | eval start=strftime(relative_time(now(), "-50min"), "%d/%m/%y %H:%M:%S:%3N"), finalization=strftime(relative_time(now(), "-30min"), "%d/%m/%y %H:%M:%S:%3N")</query>
      <earliest>-24h@h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">cell</option>
    <drilldown>
      <eval token="start">round(strptime($row.start$, "%d/%m/%y %H:%M:%S:%3N"), 3)</eval>
      <eval token="finalization">round(strptime($row.finalization$, "%d/%m/%y %H:%M:%S:%3N"), 3)</eval>
    </drilldown>
  </table>
</panel>
<panel>
  <table>
    <search>
      <query>| makeresults | eval start = "$start$", finalization = "$finalization$" | fieldformat start = strftime(start, "%d/%m/%y %H:%M:%S:%3N") | fieldformat finalization = strftime(finalization, "%d/%m/%y %H:%M:%S:%3N")</query>
      <earliest>$start$</earliest>
      <latest>$finalization$</latest>
    </search>
  </table>
</panel>

What might cause issues is the fact you're using the global tokens, you might want to switch to custom names as $earliest$ and $latest$ are always present on a dashboard. I've used $drill_start$ and $drill_end$ here.