I'm trying to pass 3 tokens from panel 1 into panel 2, earliest time, latest time, and a basic field value. I can get the earliest time and field value to work, but latest time always defaults to "now" no matter what I try.
Panel 1 is a stacked timechart over a three week period, each stack is one week. The values in the stack are different closure statuses from my SIEM. I want to be able to click on a closure status in a single week and see the details of just the statuses from that week in panel 2. (ex. Mon Jun 17-Sun Jun 23)
Panel 1 looks like:
index=siem sourcetype=triage | eval _time=relative_time(_time,"@w1") ```so my stacks start on monday```
| timechart span=1w@w1 count by status WHERE max in top10 useother=false
| eval last=_time+604800 ```manually creating a latest time to use as token```
note: panel 1 is using a time input shared across most panels in the dashboard. (defaulting to 3 Mondays ago)
In Configuration > Interaction, I'm setting 3 tokens, status=name, earliest=row._time.value, and latest=row.last.value
Panel 2 looks like:
index=siem sourcetype=triage earliest=$earliest$ latest=$latest$ | rest of search
When I click a status in week 1 (2 weeks ago) I get statuses for weeks 1, 2, and 3. (earliest and status token is working)
When I click a status in week 2 (1 weeks ago) I get statuses for weeks 2 and 3 (earliest and status token is working)
When I click a status in week 3 (current week) I get the current week. (earliest and status token is working
Latest always defaults to now.
I've done something similar in the old dashboard, I eval'd the time modifiers while setting the token, but am much less familiar with json, not sure if this is a possibility.
What I had previously done: <eval token="earliest">$click.value$-3600</eval>
... View more