I have a SimpleResultsTable configured for drilldown which dispatches several child searches that display some charts. I want the child searches to set the latest time as the event time for what was clicked and I want the earliest time to be 1 day before that event time.
For example, if you click on an event that occurred at 11/5/2011 12:30:00 I want the child searches to show events from 11/4/2011 12:30:00 to 11/5/2011 12:30:00.
Is it possible to do this with earliest and latest and intentions?
asked 18 Dec '11, 17:48
I think it is something like the following:
<search_str> starttime=relative_time($time$, "-1d@s") endtime=$time$
... if $time$ is passed by row drilldown and can be picked up by ConvertToIntention.
I haven't been able to get variations of this to work yet though.
answered 18 Dec '11, 19:01