すいません、joinはデフォルトでは1つの結果しか返さないのでした。次のように、結果を返す数を0（=無制限）にしてみるといかがでしょうか。 | inputlookup ProductA.csv | join max=0 product_name [ search index=myindex ] ... View more

I think you configure drilldown to same panel. Drilldown is enabled in the panel so hand cursor for drilldown is always displayed at this case. I recommend you to prepare other panel for drill down destination. <panel> <chart> <search> <query>your search | stats count by some_value<query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> ... <drilldown> <set token="test">$click.value$</set> </drilldown> </chart> </panel> <panel depends="$test$"> <chart> <search> <query>your search $test$| stats count by some_value<query> </query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> ... </chart> </panel> If you wish, you can switch drilldown source and destination panels in same location using reject/depend attribute, but please note it requires reloading page if you want to back to drilldown source panel. <panel rejects="$test$"> <chart> <search> <query>your search | stats count by some_value<query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> ... <drilldown> <set token="test">$click.value$</set> </drilldown> </chart> </panel> <panel depends="$test$"> <chart> <search> <query>your search $test$| stats count by some_value<query> </query> <earliest>0</earliest> <latest></latest> <sampleRatio>1</sampleRatio> </search> ... </chart> </panel> Hope it helps. ... View more

Hi, It is depends on how much data in your DB, but if you can configure timestamp as "Current index time" in Splunk DB connect and input time as "Batch", you can get all data returned by SQL with current timestamp. In this case, timestamp is not related to start time and end time column in your data. When you search recent time, you can get all data regardless start / end time. Hope it helps... ... View more