Dashboards & Visualizations

drilldown not using correct time range

lsnow
Explorer

I'm trying to do a drilldown in simple XML that uses a link like this:

/app/appname/formname?form.token=Sitename

When the new chart launches, the search is running against all time and the URL has "earliest=0" in part of the URL, after the #:

http://splunkserver/en-US/app/appname/formname?form.token=Sitename#formname?form.token=Sitename&**ea...

Even if I specify "earliest=$earliest$&latest=$latest$" in the link from the original report, I see the correct times for earliest and latest before the # in the drilldown form URL, but I end up with "earliest=0" after the #, and the search defaults to "All Time". What am I missing?

Tags (1)
0 Karma
1 Solution

Leo
Splunk Employee
Splunk Employee

thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.

View solution in original post

Leo
Splunk Employee
Splunk Employee

thank you for feedback. That is a known issue in versions 5.0/5.0.1. The fix will soon be available with release of 5.0.2.

jaywilwk
Engager

I have lately tried this again with my drilldown and I'm still getting the same result. I'm currently on splunk 6.0.3

0 Karma

jaywilwk
Engager

I've done the same thing on my drilldown and I'm getting the same result and I'm on splunk 5.0.5

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...