How to get token of span used in timechart?

[mxh7777]

Hello,

I have a search (timechart) with a dynamic span (minspan=1h)

Is there a way (token ?) to get the span used to use it in drilldown ?

Thanks

[ITWhisperer]

| streamstats range(_time) as _span window=2
| eventstats max(_span) as _span

[gcusello · Accepted solution]

Hi @mxh7777,

you can add an input to set a token for the span,

something like this:

    <input type="dropdown" token="span">
      <label>Span</label>
      <choice value="1d">1 Day</choice>
      <choice value="1w">1 Week</choice>
      <choice value="1mon">1 Month</choice>
      <default>1d</default>
    </input>

and adding to the search

| timechart span=$span$ count

Ciao.

Giuseppe

[mxh7777]

Thanks @gcusello 

It works perfectly

[gcusello]

Hi @mxh7777,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated ;-