If the chart is a timechart and the specific time range represents a single column of that chart, then you can. On the other hand if you want to select multiple columns to make a bigger timerange, and then update a table using that multi-column timerange, no I'm afraid then it's a bit harder. 1) inline drilldown, clicking a single column (or row/bar/area/marker/etc). There's a good docs overview of inline drilldown, I think at Features > Drilldown > Inline drilldown. Basically anything downstream from the JSChart/FlashChart module, notably any Searches dispatched, will automatically get the timerange updated to be the timerange clicked on in the chart. if you need to refer to the token explicitly (and 95% of the time you will not), then you can access it via $click.timeRange.earliest$ $click.timeRange.latest$ and $click.timeRange.label$ Again the docs will go over all this. 2) You can't click and drag on JSChart or FlashChart, even after extensive patching to those modules from Sideview Utils. As a result you're kind of limited to some customBehavior hacks. You might also take a look at the DateTime module, which can be used singly or in pairs to give users ability to select absolute start/end times using a widget that shows calendar dates and times of day. ... View more

yes do you know how to do that ? ... View more

How can do this with with just sideview utils by adding modules and changing parameters ... View more

OK. restating your question a bit here - "on my dashboard there are lots of panels each with a SearchControls module. Is there a way the user can effectively download csv output for all of the results for all of them at once?" The answer I'm afraid is not really. You could technically do some strange things with the append and loadjob command, to basically glom all the rows of the 25 searches together into one super-result. However the columns are presumably different from report to report and even if they weren't I think the resulting mismash.csv would be pretty confusing. However... there may be another solution. the fact that you're asking this question at all suggests that the 25 searches are at least thematically similar, and that the search language may be pretty similar. It may be feasible to refactor the dashboard so as to use the PostProcess mechanism. In this way there could be only one base search involved, and thus one set of "base search results", and 25 different postprocess searches could carve different slices out of this high-dimensional dataset, so as to render each of the 25 panels. 25 is a big number for this... However it's quite possible to break it up into 2 or 3 base searches. What I'm thinking is that you could get down to 2 or 3 SearchControls modules instead of 25... Either way getting there will involve sharing your dashboard XML as well as the full search language. It may be more of a slogfest than is palatable for you to be honest. Postprocess refactoring is a pretty advanced topic in Splunk (Read in Sideview Utils "Key Techniques > PostProcess > An Introduction to PostProcess") ... View more

yes thank you so much ... View more