How to use Time format picker

[sahana]

Hi,

i have an requirement as like below.

TimeStamp	LoginUsers	Avg SLA	Min SLA	Max SLA
20-02-2022 11:30	35	1	1	3.4
20-02-2022 11:45	40	1.3	1	5.3
20-02-2022 12:00	32	2.4	1	7.6
20-02-2022 12:15	53	1.2	1	4.2
20-02-2022 12:30	44	2.3	1	3.5

I have an above dashboard panel which was showing up on 15minutes span. Onclick of max SLA we are suppose to get the particular splunk log event in new tab. may  i know how we can work on this.

[tshah-splunk]

Additionally, if you want to have the event opened up in a new tab upon clicking on the SLA value in the table, you will need to define drilldown and link it to a search. You can find the related information here - https://docs.splunk.com/Documentation/Splunk/8.2.4/Viz/DrilldownLinkToSearch 

Be sure of using variables like $click.value$ and $click.value2$ while using drilldown to achieve proper use case

[gcusello]

Hi @sahana,

I don't know how you want to calculate avg, max and min, if you could share some additional info (e.g. examples of your logs and the aggregation logic) I could help you better in this,.

Anyway, the approach is to bin your events using the bin command and then use the stats command.

So, if you have a duration value in your events, you could run a stats command like this:

index=your_index
| bin span=15m _time
| stats count AS LoginUsers avg(duration) AS "Avg SLA" min(duration) AS "Min SLA" max(duration) AS "Max SLA" BY _time
| TimeStamp=strftime(_time,"%d-%m-%Y %H:%M")
| table TimeStamp LoginUsers "Avg SLA" "Min SLA" "Max SLA"

Ciao.

Giuseppe