Hi nick,
I am kurt. Sorry to bother you, but can I you ask a question?
I want to get a time spot(an beginning time of a time span) when users click in a chart and show it on a panel.
It works on Splunk 4.2 but not on Splunk 4.3 when doing the following :
using a Search module to slice $click.timeRange$ from an upstream module.
a. The search I run is : " index=_internal | head 1 | eval timeToken = split("$click.timeRange$", " ") | eval clickTime = mvindex(timeToken,0 ,4) | eval clickTime = mvjoin(clickTime, " ") | table clickTime
b. The value of $click.timeRange$ is : Wed Jan 25 2012 15:15:00 GMT+0800 (台北標準時間) Wed Jan 25 2012 15:30:00 GMT+0800 (台北標準時間) 1327475700 1327476600
c. After the search I get a value of Wed Jan 25 2012 15:15:00 for clickTime
making the Search module followed by a HTML module, and using $results[0].clickTime$ to show
up on a panel.
Is there anything I do wrong in 4.3 or something changed I don't realize between Splunk 4.2 and Splunk 4.3?
Any help or suggestoin will be very appreciate.
PS : the following is a part of my dashboard to get the time spot :
<module name="Search" autoRun="true" layoutPanel="panel_row2_col1">
<param name="search">index=_internal | head 1 | eval timeToken = split("$click.timeRange$", " ") | eval clickTime = mvindex(timeToken,0 ,4) | eval clickTime = mvjoin(clickTime, " ") | table clickTime </param>
<module name="HTML">
<param name="html"><![CDATA[
click time : $results[0].clickTime$
]]>
</param>
</module>
</module>
... View more