How can we set time filter on click from table view?

[Nisarg]

Is there a way we can pass epoch time from click of the table cell and set it to time filter of Splunk?

[gcusello]

Hi Nisarg,
as @niketnilay said the answer is yes.
with a click on a row of a table you can pass the timestamp of the row

<drilldown>
     <link target="_blank">/app/imy_app/drilldown_dashboard?TimeStamp=$row.-time$&token1=$row.field1$</link>
</drilldown>

If instead you want to pass the same time borders of your main search, you can use something like this (if your time picker token is callet "Time"):

<drilldown>
     <link target="_blank">/app/imy_app/drilldown_dashboard?TimeFrom=$Time.earliest$&TimeTo=$Time.latest$&token1=$row.field1$</link>
</drilldown>

for more details see https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/DrilldownIntro and the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ).

Bye.
Giuseppe

[niketn]

@Nisarg the answer to your question would be yes that may be possible.

However, for the community to assist you better you would need to add more details to your question like, what is the field name/value for table cell which has the time? What is the SPL that produces the table? Do you have span per row in your table (for example if you use timechart command)? Once you get the drilldown value for epoch time, are you planning to pass the earliest and latest token to your existing time picker input? Is the table dependent on the same time picker as well?