I have a drilldown search which should inherit the timerange from the primary search.
The timepicker encloses both searches, including the drilldown search, and should therefore inhert the timerange.
<module name="TimeRangePicker" layoutPanel="panel_row2_col1">
...
<module name="Search">
...
<module name="SimpleResultsTable">
...
<param name="drilldown">row</param>
<module name="Search">
...
</module>
</module>
</module>
</module>
</module>
The full view can be found here: pastebin.com
The SimpleResultsTable module will use the _time field value for the timerange of the drilldown search since you're displaying it. A simple workaround is to create a new field with the timestamp value:
index=_internal $seriesToken$ | eval time=strftime(_time,"%m/%d/%y %I:%M:%S.%3N %p") | table time, series
The SimpleResultsTable module will use the _time field value for the timerange of the drilldown search since you're displaying it. A simple workaround is to create a new field with the timestamp value:
index=_internal $seriesToken$ | eval time=strftime(_time,"%m/%d/%y %I:%M:%S.%3N %p") | table time, series