What does the log say? ... View more

I did that before putting this query. As it is sample event so the query not able to populate the _time column. Is it possible to make this query a dynamic. Dynamic means query pick the "sample" from incoming events. As the "sample" make it static even if status will change it wont get reflect in the output. Post that i think _time column would get populate with the value ... View more

Check this out: https://conf.splunk.com/session/2013/Using_Splunk_LisaGuinn_HowToUseDynamicDrilldown.pdf Also this: http://docs.splunk.com/Documentation/Splunk/6.4.2/Viz/Understandbasictableandchartdrilldownactions It's going to look a bit like this: MAIN DASHBOARD: <dashboard> <label>Dynamic Drilldown</label> <row> <panel> <table> <search> <query>index=indexName ERROR | chart count by host </query> <earliest>-7d@h</earliest> <latest>now</latest> </search> <drilldown> <link target="_blank"> /apps/MyApp/drilldown_target_dashboard_name?host=$row.host$ </link> </drilldown> <option name="drilldown">row</option> </table> </panel> </row> </dashboard> DRILLED INTO DASHBOARD: <dashboard> <row> <panel> <chart> <title>Host Application Error Details/title> <search> <query> index=indexName host=$row.host$ | stats count by Application </query> <earliest>-30d@d</earliest> <latest>now</latest> </search> </chart> </panel> </row> </dashboard> ... View more

Try this cron, (running for hour 0 to 1, skip 2 and then from hour 3 to 23). 0 0-1,3-23 * * * ... View more