Hi All,
I am trying to create a drilldown for my timechart, the idea is to drill down to the events that happened 30 mins before and after the clicked time (click.value in my case). I referred the answer
https://answers.splunk.com/answers/215176/subtracting-30-minutes-from-passed-drilldown-param.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev
Now this is helping me pass the earliest time, but when i use the same concept with the latest time i am not getting the desired result. Below is my current query:
index="tutorial" categoryId=strategy earliest=[|gentimes start=-1|eval new = relative_time($click.value$,"-1800")| return $$new] latest=[|gentimes start=-1|eval latest1 =($click.value$ + 1800)| return $$latest1] | top clientip
after passing through the drilldown pipeline the query changes to:
index="tutorial" categoryId=strategy earliest=[|gentimes start=-1|eval new = relative_time(1572728400.000,"-1800")| return $new] latest=[|gentimes start=-1|eval latest1 =(1572728400.000 1800)| return $latest1] | top clientip
If you look closely the + sign just vanished. I tried many ways to find a work around for that but wasn't able to. Please take a look and try to run the query once by yourself.
@Raghav2384 @RVDowning @somesoni2 @woodcock @gcusello @mayurr98 please help guys!!
... View more