Getting Data In
Highlighted

How to show event in drilldown from a clickable timestamp

New Member

I want to show event in drilldown for specific timestamp I click on in source dashboard table.
Please help me with this.

0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

SplunkTrust
SplunkTrust

More information would be helpful, but it could be as simple as passing $row._time$ to your drilldown search.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

New Member

i tried "where _time=$clicked.value$(where i click on timestamp)" in drilldwon search but it is not working.

0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

New Member

@richgalloway - how do i pass that ?

0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

SplunkTrust
SplunkTrust

The correct term is $click.value$, but that assumes the user clicked on a cell with a time in it. That's why is suggested `$row._time$. See https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/DrilldownIntro for more.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

Legend

Hi sachinbansal,
I suggest to see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ) where you can find very useful examples of hot to drilldown from a table.
Anyway, let me understand:

  • you have a list of events in a dashboard panel,
  • you want to click on one of these events
  • and search in a different dashboard passing as parameter the timestamp of the clicked events

Correct?

If this is your request, you have to insert in the main dashboard, in your panel's source this section:

<drilldown>
   <link target="_blank">/app/my_app/new_dashboard?_time=$click.value2$</link>
</drilldown>

Then in the secondary dashboard, you have to insert the token.

Bye.
Giuseppe

0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

New Member

Hi Giuseppe,

When i click on table row it then in drilldown it should show me that event in full.

Regards,
Sachin

0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

Legend

@sachinbansal if your ask is to get the earliest and latest from timechart table you can refer to the following workaround based answer https://answers.splunk.com/answers/587132/drilldown-pass-the-earliest-and-latest-from-a-time.html

<drilldown>
           <eval token="drilldown.earliest">strptime($row._time$,"%Y-%m-%d %H:%M:%S")</eval>
           <eval token="drilldown.latest">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval>
</drilldown>
0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

New Member

Hi Niketn,
I do not want to pass earliest and latest from timechart table. I want that when i click on any row in table it should drill down to that particular full event.

Regards,
Sachin

0 Karma
Highlighted

Re: How to show event in drilldown from a clickable timestamp

Motivator

Hi @sachinbansal,

If you are having timechart and you want to see events related to point you click on it, follow below steps:

  • Click edit dashboard
  • Click on three vertical dots on the panel top-right
  • Edit drilldown
  • Select "Link to Search"
  • Keep the value "Auto" and Apply.
  • Save the dashboard and now if you click on the chart you will see events related to point you clicked on.

One thing you require to understand is that the point you see on timechart is not necessarily related to only one event. As timechart groups the event to limit the data points. For example if you choose Last 24 hours it groups the data in 1 hour of span and on drilldown you will see related events.

But if you want to use some other dashboard to panel to show you can use $earliest$ and $latest$ to get earliest value and latest value use it like below to drilldown.

<drilldown>
    <link target="_blank">/app/my_app/new_dashboard?earliest=$earliest$&latest=$latest$</link>
</drilldown>

Hope this helps!!!

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.