How to use 15m time value (epoch parameter) from chart on drilldown?

[loganseth]

Hi.

I have a classic dashboard and am using a bar chart with

| timechart span=15m count

And I can pass that with $click.value$ to the drilldown dashboard, but thoughts on how to use that?

Unlike 'earliest' and 'latest' it's just a single value and the data does not have a 15m epoch value, so I think (at a high level), I'd need to

1. eval the _time column to create 15m buckets and then search for those, but probably also
2. pass the global parms (as well) to filter my results?

So, ya, I'm used to traditional SQL, so I could say 'WHERE time BETWEEN this AND that' but here I have to figure out how to 'match if the _time value is in this 15m epoch time' so I'm lost.

Thank you for thoughts!

[ITWhisperer]

In the drilldown, evaluate a token using relative_time($click.value$,"+15m") and use both tokens in the url

[VatsalJagani]

Hello @loganseth , I'm a Splunk community moderator.

I just wanted to check if this answered your question. Can you mark the answer as a correct solution by clicking on "Accept as Solution"?

[loganseth]

it's a cool concept, but I can't get this to work.

imagine the drilldown brings back the individual records for that 15m interval.  the SPL panel supports tokens, of course, but there isn't a way I can use either, it seems - probably my issue.

on click i create time_val=$click.value$

in new chart, i see time_val in the url (time_val=1658978100.000)

but then when I add $time_val$ as a token (in the dashboard panel) for earliest, i get 'invalid earliest_time' so stuck actually implementing your suggestion.