Why is earliest not working on dashboard timepicke...

yhovakeemian_sp · ‎08-30-2019

Hi Splunkers,

I'm trying to get a dashboard timepicker to change on click to essentially zoom into the click value of a timechart + and - 60 mins. The below seems to be working just fine for the latest token, however, the earliest is doing nothing and it looks like it is reverting back to the original default on the dashboard.

<drilldown>
          <eval token="field2.earliest">relative_time($click.value$,"-60m")</eval>
          <eval token="field2.latest">relative_time($click.value$,"+60m")</eval>
        </drilldown>

field2 is my timepicker in the above.

Thanks in advance for the help.

niketn · ‎11-01-2019

@yhovakeemian_splunk seems strange but try using form. and validate that time input form variables are updated in the URL or not.

    <drilldown>
      <eval token="form.field2.earliest">relative_time($click.value$,"-60m")</eval>
      <eval token="form.field2.latest">relative_time($click.value$,"+60m")</eval>
    </drilldown>

Also, for the community to assist you better please provide your current SPL which generates the time series for the table.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

DalJeanis · ‎09-05-2019

set a token and display it on the dash to see what $click.value$ is returning.

   <drilldown>
       <eval token="field2.earliest">relative_time($click.value$,"-60m")</eval>
       <eval token="field2.latest">relative_time($click.value$,"+60m")</eval>
       <eval token="displayClickValue">$click.value$</eval>
     </drilldown>

Then somewhere you can see it, put this panel

  <panel>
  <html>
  <p> Click Value is "$displayClickValue$" </p>
  </html>
 </panel>

Why is earliest not working on dashboard timepicker token on click.value?

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

Troubleshooting the OpenTelemetry Collector

Adoption of Infrastructure Monitoring at Splunk