|
I have a SimpleResultsTable configured for drilldown which dispatches several child searches that display some charts. I want the child searches to set the latest time as the event time for what was clicked and I want the earliest time to be 1 day before that event time. For example, if you click on an event that occurred at 11/5/2011 12:30:00 I want the child searches to show events from 11/4/2011 12:30:00 to 11/5/2011 12:30:00. Is it possible to do this with earliest and latest and intentions? |
|
I think it is something like the following: <search_str> starttime=relative_time($time$, "-1d@s") endtime=$time$ ... if $time$ is passed by row drilldown and can be picked up by ConvertToIntention. I haven't been able to get variations of this to work yet though. |