More information would be helpful, but it could be as simple as passing
$row._time$ to your drilldown search.
i tried "where _time=$clicked.value$(where i click on timestamp)" in drilldwon search but it is not working.
The correct term is
$click.value$, but that assumes the user clicked on a cell with a time in it. That's why is suggested `$row._time$. See https://docs.splunk.com/Documentation/Splunk/7.3.0/Viz/DrilldownIntro for more.
I suggest to see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ) where you can find very useful examples of hot to drilldown from a table.
Anyway, let me understand:
If this is your request, you have to insert in the main dashboard, in your panel's source this section:
<drilldown> <link target="_blank">/app/my_app/new_dashboard?_time=$click.value2$</link> </drilldown>
Then in the secondary dashboard, you have to insert the token.
When i click on table row it then in drilldown it should show me that event in full.
@sachinbansal if your ask is to get the earliest and latest from timechart table you can refer to the following workaround based answer https://answers.splunk.com/answers/587132/drilldown-pass-the-earliest-and-latest-from-a-time.html
<drilldown> <eval token="drilldown.earliest">strptime($row._time$,"%Y-%m-%d %H:%M:%S")</eval> <eval token="drilldown.latest">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval> </drilldown>
I do not want to pass earliest and latest from timechart table. I want that when i click on any row in table it should drill down to that particular full event.
If you are having timechart and you want to see events related to point you click on it, follow below steps:
One thing you require to understand is that the point you see on timechart is not necessarily related to only one event. As timechart groups the event to limit the data points. For example if you choose Last 24 hours it groups the data in 1 hour of span and on drilldown you will see related events.
But if you want to use some other dashboard to panel to show you can use
$latest$ to get earliest value and latest value use it like below to drilldown.
<drilldown> <link target="_blank">/app/my_app/new_dashboard?earliest=$earliest$&latest=$latest$</link> </drilldown>
Hope this helps!!!