How to create a drilldown from timechart to get all the events based datapoint clicked?

[satishp00]

Hi ,

I m new to splunk and still exploring. I have created a timechart with a span on 10 mins . The timechart has a sharedtime picker which gets updated on based on time selected on timepicker. I have added a drilldown option on timechart when on click link to search and the results should display in new tab. I m passing TimeRange as Tokens. What I m trying to achieve is when a user clicks on the timechart at any datapoint,it should display the results with all events that happened the  in past 5 min of clicked timestamp. Some how I m not sure how to set the earliest and latest time dynamically in the search link. 

[Tom_Lundie · Accepted solution]

You can't dynamically change the token value like you're trying to do in the drilldown config.

The simplest way to solve this is to update a different token and use that to pass to your dashboard:

Example:

        <drilldown>
          <eval token="dd_earliest">$click.value$-300</eval>
          <eval token="dd_latest">$click.value$</eval>
          <link target="_blank">search?q=index%3D%22xxxx%22%20sourcetype%3D%22xxxx%22%20%7C%20table%20ProcessTime%2C%20FileName%2C%20StartDtTime%2C%20EndDtTime&amp;earliest=$dd_earliest$&amp;latest=$dd_latest$</link>
        </drilldown>

If it's a deal-breaker to have to manually URL-encode your drilldown search, you could also get the drilldown search to generate it's earliest and latest times dynamically with a subsearch. Set the drilldown time config to global use the folllowing drilldown search:

index="xxxx" sourcetype="xxxx" 
    [| makeresults 
    | eval earliest=$click.value$ - 300, latest=$click.value$
    | fields - _time
    | format] 
| table ProcessTime, FileName, StartDtTime, EndDtTime