Splunk Search

Drilldown - pass the earliest and latest from a timechart

Path Finder

Hi everyone,

Im having a problem passing the earliest and latest from a timechart.
On the main graph, im showing a table with hourly interval which shows some counter for each column.
I wanted to pass the selected column and to show it on a different timechart with minutely interval.

the tokens I configured on the main graph are:
jnl_mb_counter = $click.name2$
jnl_mb_earliest = $earliest$
jnl_mb_latest = $latest$

The column is passing perfectly, but the time is always the entire time (if i have 3 hours - which are 3 rows in the main graph's table, no matter which hour i choose, i get the drilldown timechart with the entiretime)

The drilldown query is:
index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA earliest=$jnl_mb_earliest$ latest=$jnl_mb_latest$ | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | search IDs=$jnl_mb_counter$ | timechart span=1m avg(transfer_in_MB) as "$jnl_mb_counter$ Transfer"

Thank you very much!

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi All,
Here's another workaround given to me by one of our intrepid engineers that might work better than the one already posted:

          <eval token="drilldown.earliest">strptime($row._time$,"%Y-%m-%d %H:%M:%S")</eval>
          <eval token="drilldown.latest">strptime($row._time$,"%Y-%m-%d %H:%M:%S") + $row._span$</eval>

View solution in original post


The _span field indicates the bin or bucket size from your timechart command, in your case 1h or 3600 seconds. Anytime you use a SPL function that performs bin'ing, the hidden _span field is present. That field tells Splunk how to space out data on the x-axis when you chart timecharts.

Please "like" or "upvote" my comment or you can turn it into an answer and accept it. Either way.

Path Finder

thank you!, i upvoted it, when can i click "accept" on it?

0 Karma


Click on Accept link of Answer.
Scroll up to the first comment.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...