Splunk Search

How to make timeline drilldown time parameters?

michaeler
Communicator

I'm trying to do a drilldown of a timechart where the Y-axis field is Domain and the value is a count, X-axis is time by Day. I've done this successfully with other visualizations but am having trouble passing the time on the x-axis into my new search. Everything seems to be working but every time it's run, I get "No results found"

 

index=main sourcetype=mysourcetype
| eval start=$dd_earliest$
| eval end=start+86399
| eval earliest=strftime(start, "%m/%d/%Y%H:%M:%S"), latest=strftime(end, "%m/%d/%Y%H:%M:%S")
| search Domain=$selected_domain$ earliest=earliest latest=latest
| rest of search.....

 

Here's what I have for the search it's drilldowned from:

<drilldown>
  <set token="selected_domain">$click.name2$</set>
  <set token="dd_earliest">$click.value$</set>

The values all pass though correctly but there is something wrong with my earliest and latest in my search. I've tried using the start and end values instead, surrounding them in quotes, and a few other things but to no avail. 

Labels (3)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using starttime and endtime with strings as values.

index=main sourcetype=mysourcetype
| eval start=$dd_earliest$
| eval end=start+86399
| eval earliest="\"".strftime(start, "%m/%d/%Y:%H:%M:%S")."\"", latest="\".strftime(end, "%m/%d/%Y:%H:%M:%S")."\""
| search Domain=$selected_domain$ starttime=earliest endtime=latest
| rest of search.....

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...