@potnuru if your intent is to display human readable string time in the table however, drilldown using the epoch time, then there are four options you can use including the one suggested by @kamlesh_vaghela which is available as an example in the Splunk Dashboard Examples app on Splunkbase.
If you would notice all four tables in the screenshot below show time as string time in the table however, the drilldown token in the table title is epoch.
Option 1: if _time is the first field in table then use $click.value$ table drilldown token to access epoch time.
Option 2: the table <drilldown> event handler can have <eval> section to convert string time in the table and set token as epoch time.
Option 3: Create a separate field for epoch timestamp apart from string time stamp field for displaying in the table. Make the epoch timestamp field hidden by prefixing the field name with underscore character. In the example it is _hiddenTimeEpochForDrilldown.
Option 4: hidden field through <fields> <table> Simple XML configuration option. If out of 3 fields in the table only 2 are listed in the fields section then, third field is still available for drilldown but not displayed in the table. In the following example it is <fields>["time_number","data"]</fields>. (Kamlesh also has posted same example.)
Following is a run anywhere dashboard with examples of all four approaches:
<dashboard>
<label>Table with Time Drilldown</label>
<row>
<panel>
<title>Option 1 - if _time is the first field in table then use click.value table drilldown token to access epoch time</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption1$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| table _time data</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="tokTimeNumberOption1">$click.value$</set>
</drilldown>
</table>
</panel>
<panel>
<title>Option 2 - drilldown eval to set token as epoch</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption2$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| rename _time as time_number
| table time_number data
| eval time_number=strftime(time_number,"%Y/%m/%d %H:%M:%S")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<eval token="tokTimeNumberOption2">strptime($row.time_number$,"%Y/%m/%d %H:%M:%S")</eval>
</drilldown>
</table>
</panel>
</row>
<row>
<panel>
<title>Option 3 - keep epoch time field hidden by prefixing fieldname with underscore and use for drilldown</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption3$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| rename _time as time_number
| table time_number data
| eval _hiddenTimeEpochForDrilldown=time_number
| eval time_number=strftime(time_number,"%Y/%m/%d %H:%M:%S")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="tokTimeNumberOption3">$row._hiddenTimeEpochForDrilldown$</set>
</drilldown>
</table>
</panel>
<panel>
<title>Option 4 - hidden field through <fields> table SimpleXML configuration option</title>
<table>
<title>Clicked row Time Epoch: $tokTimeNumberOption4$</title>
<search>
<query>| makeresults count=5
| eval data=random(), data=substr(data,0,3), delta=300
| accum delta
| eval _time=_time-delta
| fields - delta
| rename _time as time_number
| table time_number data
| eval hiddenTimeEpochForDrilldown=time_number
| eval time_number=strftime(time_number,"%Y/%m/%d %H:%M:%S")</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<fields>["time_number","data"]</fields>
<drilldown>
<set token="tokTimeNumberOption4">$row.hiddenTimeEpochForDrilldown$</set>
</drilldown>
</table>
</panel>
</row>
</dashboard>
Please try out and confirm. Hope at least one option works out for you! 🙂
