Hello,
In my dashboard, I need to define the custom drilldown where I would like to transport the _time, which is in the first column of my panel table. For that I need to have earliest and latest defined, where latest would be = earliest+1ms (at least that is how the Auto drilldown option gets it).
How would I do it?
My custom drilldown search looks as follows at the moment:
index=mlbso sourcetype=*_transports source="*$sourcesid$*.$targetsid$" transport_exitcode=8 earliest=$click.value$ latest=???
Please adise.
Kind Regards,
Kamil
You should be able to do an eval to add the time.
<drilldown>
<eval token="latesttime">$click.value$+1ms</eval>
<link>index=mlbso sourcetype=*_transports source="*$sourcesid$*.$targetsid$" transport_exitcode=8 earliest=$click.value$ latest=$latesttime$</link>
</drilldown>
You should be able to do an eval to add the time.
<drilldown>
<eval token="latesttime">$click.value$+1ms</eval>
<link>index=mlbso sourcetype=*_transports source="*$sourcesid$*.$targetsid$" transport_exitcode=8 earliest=$click.value$ latest=$latesttime$</link>
</drilldown>
Thank you.
It worked with
<eval token="latesttime">$click.value$+1ms</eval>
$click.value$+0.001