Drilldown - pass the earliest and latest from a timechart

[netanelm7]

Hi everyone,

Im having a problem passing the earliest and latest from a timechart.
On the main graph, im showing a table with hourly interval which shows some counter for each column.
I wanted to pass the selected column and to show it on a different timechart with minutely interval.

the tokens I configured on the main graph are:
jnl_mb_counter = $click.name2$
jnl_mb_earliest = $earliest$
jnl_mb_latest = $latest$

The column is passing perfectly, but the time is always the entire time (if i have 3 hours - which are 3 rows in the main graph's table, no matter which hour i choose, i get the drilldown timechart with the entiretime)

The drilldown query is:
index=storage_18037 sourcetype=csvRotemA_JNL_SUMMARY NOT DATETIME host=RotemA earliest=$jnl_mb_earliest$ latest=$jnl_mb_latest$ | eval transfer_in_MB=M_JNL_ASYNC_XFER_RATE/1024,IDs="JNL".JOURNAL_ID | search IDs=$jnl_mb_counter$ | timechart span=1m avg(transfer_in_MB) as "$jnl_mb_counter$ Transfer"

Thank you very much!

[rjthibod]

The _span field indicates the bin or bucket size from your timechart command, in your case 1h or 3600 seconds. Anytime you use a SPL function that performs bin'ing, the hidden _span field is present. That field tells Splunk how to space out data on the x-axis when you chart timecharts.

Please "like" or "upvote" my comment or you can turn it into an answer and accept it. Either way.

[netanelm7]

thank you!, i upvoted it, when can i click "accept" on it?

[kamlesh_vaghela]

Click on Accept link of Answer.
Scroll up to the first comment.