Dashboards & Visualizations

Dynamic Drilldown value to the time input type

Raghav2384
Motivator
Hey Experts,

We are using dynamic drilldown on a table which passes certain values to another dashboard. We want to pass the timestamp/time from the source table to the destination form element. It works if i have a custom input like textbox or dropdown. We want it to pass the value to time preset dropdown (input type="time"). Is it possible?

some thing like 
On source Dashboard:
<drilldown>
<link>..../?form.time_input_tok = $row._time$
<drilldown>

On Destination dashboard
<fieldset>
<input type=time token="time_input_tok" searchWhenChanged="true">
</input>
</fieldset>

On click, that splunk's time dropdown should get the row _time value. Thanks in advance

Raghav
Tags (2)
0 Karma

ramdaspr
Contributor
?form.testtime_tok.earliest=$row._time$&form.testtime_tok.latest=$row._time$

should do the trick.

Raghav2384
Motivator
Nope, tried that and it's not passing the values
Example: i have a table with time stamp "2015-02-04" and value "25" for the field Score on row x. If user clicks on 25, i want it to pass "2015-02-04 00:00:00" as earliest time and "2015-02-04 23:59:59" as latest time. 

Any advice?
Thanks,
Raghav
0 Karma

ramdaspr
Contributor

AFAIK there isnt a straightforward way to achieve that.

The only way I can think of is to have a hidden query on the taget dashboard which accepts this row date as a token and then using eval statements to create the 00:00:00 earliest and 23:59:59 time for latest property on the time dropdown.

0 Karma

Raghav2384
Motivator

Can give me an example of usage? Appreciate your help.

Thanks,
Raghav

0 Karma

ramdaspr
Contributor

Ah sorry, that comment was well before I had my morning coffee so it wasnt very useful.

Since it isnt possible to set tokens via eval, it is probably the best to create two additional column in your source dashboard table to create a values for "2015-02-04 00:00:00" and "2015-02-04 00:00:00" and then pass those values to the destination dashboard.

You can simply eval et=_time." 00:00:00" | eval lt=_time." 23:59:59" to create two fields which have the required offset and then pass the $row.et$ and $row.lt$ tokens on to the destination dashboard.

Raghav2384
Motivator

I will give it a try....i might have to tweak the millis or directly add 86400 to the lt...Appreciate your help

0 Karma
Get Updates on the Splunk Community!

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...