topic Re: DrillDown $row.LastQuery$ is not replaced by the clicked row in Dashboards & Visualizations

DrillDown $row.LastQuery$ is not replaced by the clicked row

lpolo — Mon, 28 Sep 2020 13:33:22 GMT

I have the panel presented below that is doing the drill down. However, the variable I want to pass to the drill search "$row.LastQuery$" is not being updated. Also, splunk UI modifies the search by adding at the end of my search "|search Date="03/19/2013". The value of Date seems to be the period of the first search. How can I fix the panel so the variable is correctly replaced and the search is not modified ?

<module name="HiddenSearch" layoutPanel="panel_row5_col3" autoRun="True">
<param name="search">earliest=-1d@d latest=@d splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily NOT TotalSearches AND rank|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param>
<param name="groupLabel">Top N - Yesterday</param>
<module name="StaticContentSample">
<param name="text"><![CDATA[<H1>Top N Searches - Yesterday</H1>]]></param>
</module>
<module name="Paginator">
<param name="entityName">results</param>
<param name="maxPages">20</param>
<param name="count">10</param>
<module name="SimpleResultsTable">
<param name="drilldown">row</param>
<module name="HiddenSearch">
<param name="search">earliest=-31d@d latest=@d splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily NOT TotalSearches AND rank AND LastQuery="$row.LastQuery$"|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param>
<module name="ConvertToDrilldownSearch">
<module name="JobProgressIndicator" />
<module name="SimpleResultsHeader">
<param name="headerFormat">Velocity</param>
<param name="entityName">events</param>
</module>
<module name="Paginator">
<param name="entityName">events</param>
<param name="maxPages">10</param>
<module name="SimpleResultsTable">
<param name="entityName">results</param>
<param name="displayRowNumbers">False</param>
<param name="drilldown">none</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>

Thanks,
Lp

Re: DrillDown $row.LastQuery$ is not replaced by the clicked row

sideview — Thu, 21 Mar 2013 17:42:33 GMT

ConvertToDrilldownSearch just does this weird automatic drilldown logic, where it'll take the value from the first column, and try and add it as a searchterm. In this case though, you want to add specifically the 'LastQuery' value, and to a specific place in the search. For that you'll need to replace ConvertToDrilldownSearch with a ConvertToIntention module and you'll need to get the extremely finicky syntax right for the stringreplace intention to work.

Also I'm not sure how in the core systems you specify that you want a particular field value to be used from the drilldown, rather than just specifying $click.value$ as the value of the first row. I'm actually not sure you can, at least I think you need some other module to be involved somehow.

With Sideview Utils the drilldown is quite easy, and actually the whole config becomes a lot simpler in a lot of ways. Here's a converted view with the same functionality but with no intentions to ever think about and with less XML.

<module name="Search" layoutPanel="panel_row5_col3" autoRun="True">
  <param name="search">splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily NOT TotalSearches AND rank|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param>
  <param name="earliest">-1d@d</param>
  <param name="latest">@d</param> 
  <module name="HTML">
    <param name="html"><![CDATA[<H1>Top N Searches - Yesterday</H1>]]></param>
  </module>
  <module name="Pager">
    <module name="Table">
      <module name="Search">
        <param name="search">earliest=-31d@d latest=@d  splunk_server=io-splunk-03.example.com index="si_top_n" Sampling_Rate=Daily NOT TotalSearches AND rank AND LastQuery="$row.fields.LastQuery$"|sort + rank|eval Date=strftime(_time, "%m/%d/%Y") |table Date rank LastQuery count percent</param>
        <module name="JobProgressIndicator" />
        <module name="SimpleResultsHeader">
          <param name="headerFormat">Velocity</param>
          <param name="entityName">results</param>
        </module>
        <module name="Pager">
          <module name="Table"></module>
        </module>
      </module>
    </module>
  </module>
</module>

While I was converting it, I noticed a couple things that I fixed.

-- you had config to redirect to flashtimeline on the last table, but it was turned off via the <param name="drilldown">none</param> Since it was disabled I just deleted this.
-- you had your paginator and your SimpleResultsTable configured to display events, but on a search that was actually getting 'results'. This is a weird point but it might have been causing some confusion. I just left Pager and Table set to the defaults which will work fine here.

Note that you should get the latest Sideview Utils (2.4.3) from the sideview site at http://sideviewapps.com/apps/sideview-utils/ rather than the version on Splunkbase which is out-of-date (1.3.5).

Re: DrillDown $row.LastQuery$ is not replaced by the clicked row

lpolo — Fri, 22 Mar 2013 11:40:20 GMT

It worked.
Thanks,
Lp