Dashboards & Visualizations

drilldown not using correct time range

lsnow
Explorer

I'm trying to do a drilldown in simple XML that uses a link like this:

/app/appname/formname?form.token=Sitename

When the new chart launches, the search is running against all time and the URL has "earliest=0" in part of the URL, after the #:

http://splunkserver/en-US/app/appname/formname?form.token=Sitename#formname?form.token=Sitename&**ea...

Even if I specify "earliest=$earliest$&latest=$latest$" in the link from the original report, I see the correct times for earliest and latest before the # in the drilldown form URL, but I end up with "earliest=0" after the #, and the search defaults to "All Time". What am I missing?

Tags (1)
0 Karma
1 Solution

Leo
Splunk Employee
Splunk Employee

thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.

View solution in original post

Leo
Splunk Employee
Splunk Employee

thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.

jaywilwk
Engager

I have lately tried this again with my drilldown and I'm still getting the same result. I'm currently on splunk 6.0.3

0 Karma

jaywilwk
Engager

I've done the same thing on my drilldown and I'm getting the same result and I'm on splunk 5.0.5

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...