hello
I use a click value token on my timechart in order to display details
it works but now what I need is when I click on a specific bar of my timechart (it means a bar for a specific day) I need to display only the data for this date
how to do this please
<search>
<query>index=tutu sourcetype=toto ezconf=$ezconf$
| timechart span=1d count(hang)as hang</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<drilldown>
<set token="hang">$click.value$</set>
</drilldown>
</chart>
</panel>
</row>
<row>
<panel depends="$hang$">
<title></title>
<table>
<title></title>
<search>
<query>index=toto sourcetype=tutu ezconf=$ezconf$
| eval time = strftime(_time, "%d-%m-%y %H:%M")
| sort - time
| table time hang</query>
<earliest>-7d@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
The earliest and latest values are available as tokens:
<drilldown>
<set token="earliest_tok">$earliest$</set>
<set token="latest_tok">$latest$</set>
</drilldown>
You can use these tokens in your other visualization searches:
<search>
<query>index=toto sourcetype=tutu ezconf=$ezconf$
| eval time = strftime(_time, "%d-%m-%y %H:%M")
| sort - time
| table time hang</query>
<earliest>$earliest_tok$</earliest>
<latest>$latest_tok$</latest>
</search>
You can initialize earliest_tok and latest_tok to default values using a time input or a combination of <init> and <set> tags.
The earliest and latest values are available as tokens:
<drilldown>
<set token="earliest_tok">$earliest$</set>
<set token="latest_tok">$latest$</set>
</drilldown>
You can use these tokens in your other visualization searches:
<search>
<query>index=toto sourcetype=tutu ezconf=$ezconf$
| eval time = strftime(_time, "%d-%m-%y %H:%M")
| sort - time
| table time hang</query>
<earliest>$earliest_tok$</earliest>
<latest>$latest_tok$</latest>
</search>
You can initialize earliest_tok and latest_tok to default values using a time input or a combination of <init> and <set> tags.