Dashboards & Visualizations

How to drilldown time from a panel and use it to calculate the earliest and latest values to run other panels?

Arpit_S
Path Finder

The first panel in the dashboard is a table having Time as one field (this table is not a result of timechart command) and other fields.
I have configured a token to always pick the value of time field every time a row is clicked in the first panel. I checked, the token is being assigned the value of the time from the row being clicked, then I am using this value to calculate (-/+) 30 minutes which i'll be using as earliest and latest time for the other panels. The calculated values are showing the exact time but when using those values as earliest and latest in other panels, panels are running for a time range which is 9 hours earlier than the selected time.

Below is the drilldown section, (NOTE: Time is the left most field in the table that's why i have used $click.value$)

      <eval token="epochtime">strptime($click.value$, "%Y-%m-%d %H:%M:%S" )</eval>
      <eval token="earliesttok">epctime-1800</eval>
      <eval token="latesttok">epctime+1800</eval>

Has anyone run into some similar issue?

Please have a look and let me know.

Thanks.

Tags (2)
0 Karma
1 Solution

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

View solution in original post

HiroshiSatoh
Champion

Due to this specification the time goes wrong.

eval expression functions with different behavior for dashboards

relative_time(X,Y): Uses client time zone.
strftime(X,Y): Uses client time zone.
strptime(X,Y): Uses client time zone.

I think that you should set plus, minus 30 minutes in the search sentence and do not display it.
You can set the fields to display using the fields tag.

arpit_1210
Explorer

Thanks @HiroshiSatoh, the solution you provided worked.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...