Dashboard Drilldown: How to use the timechart command to pass _time or time fields to a form?

[chengyu]

Hi guys,

index=_internal sourcetype=stream:stats host=*  | spath Output=TcpSessionCount path=sniffer{}.processors{}.tcpSessionCount | fields - _raw | fields host TcpSessionCount  | stats sum(TcpSessionCount) as TotalTcpSessionCount by host,_time | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) AS Time  | fields,host,Time,TotalTcpSessionCount |  stats avg(TotalTcpSessionCount) by Time

XML:

<drilldown>
/app/HTTP_DDoS_Monitor/High_DDoS_SRC_IP?form.Time=$row.Time$
</drilldown>
I can transfer $row.Time$ to a form. If I want to use timechart avg(TotalTcpSessionCount) as TcpSessionCount by host the $row.Time$ can't be transferred to a form. Can I use the timechart command to transfer _time or Time fields to a form?

index=_internal sourcetype=stream:stats host=*  | spath Output=TcpSessionCount path=sniffer{}.processors{}.tcpSessionCount | fields - _raw | fields host TcpSessionCount  | stats sum(TcpSessionCount) as TotalTcpSessionCount by host,_time | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(_time) AS Time  | fields,host,Time,TotalTcpSessionCount |  **timechart avg(TotalTcpSessionCount) as TcpSessionCount by host** 

[chengyu · Accepted solution]

I refer http://answers.splunk.com/answers/194879/dynamic-drilldown-pass-the-timechart-commands-time.html resolve it.

[woodcock]

You should click "Accept" on your answer if it worked for you.