https://community.splunk.com/t5/Splunk-Search/Drilldown-not-working-with-Join-Command/m-p/21547#M3541 <P>In order to work around this limitation, I had to leverage Sideview Utils <CODE>Redirector</CODE> component to build a custom search <CODE>url</CODE> to support the drill down behavior. The other gotcha was creating <STRONG>event types</STRONG> for each join duration type so that the drill down could filter by the proper bucket.</P> <P>After removing the default <CODE>ConvertToDrilldownSearch</CODE> module, here is the stub of the <CODE>Redirector</CODE>:</P> <PRE> <MODULE name="FlashChart"> <MODULE name="Redirector"> <OBJECT><PARAM name="popup" />True <PARAM name="url" />flashtimeline <PARAM name="arg.q" />search index="myIndex" host=myHost username="$click.value$" eventtype="#$click.name2$" | stats values(cs_uri_stem) as "Pages Accessed", count as "[Pages Viewed $click.name2$]" by username" </OBJECT></MODULE> </MODULE> </PRE> <P>The biggest let down of using the splunk markup is that their is no easy way to do conditionals inside a param - or performing an inline evaluation. Maybe this is just my lack of know-how. I've also learned that <CODE>ConvertToIntention</CODE> is completely useless when you need complete control over the search query (<EM>e.g. q=search index=myIndex</EM>). Stick with SideView Utils <CODE>Redirector</CODE> if you need complete search query control.</P> Wed, 07 Nov 2012 07:08:20 GMT slierninja 2012-11-07T07:08:20Z https://community.splunk.com/t5/Splunk-Search/Drilldown-not-working-with-Join-Command/m-p/21546#M3540 <P><A href="http://splunk-base.splunk.com/answers/64069/grouping-aggregate-queries-together/64075">I figured out how to create monthly buckets using the <CODE>join</CODE> command</A>, but now I cannot drilldown into my results. Can someone help me figure out how to rewrite my query or enable drilldowns using the <CODE>join</CODE> command?</P> <H3>Splunk Error Message</H3> <P><EM>Encountered an unexpected error while parsing intentions.</EM><BR /><BR /> <EM>PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'join' command</EM>.</P> <H3>Query</H3> <PRE> index="myIndex" host=myHost daysago=30 | stats Count as 30Days by username | join username [search index="myIndex" host=myHost daysago=60 | stats Count as 60Days by username] | join username [search index="myIndex" host=myHost daysago=90 | stats Count as 90Days by username] | join username [search index="myIndex" host=myHost daysago=120 | stats Count as 120Days by username]|fields username, 30Days, 60Days, 90Days, 120Days </PRE> Fri, 02 Nov 2012 14:38:33 GMT https://community.splunk.com/t5/Splunk-Search/Drilldown-not-working-with-Join-Command/m-p/21546#M3540 slierninja 2012-11-02T14:38:33Z https://community.splunk.com/t5/Splunk-Search/Drilldown-not-working-with-Join-Command/m-p/21547#M3541 <P>In order to work around this limitation, I had to leverage Sideview Utils <CODE>Redirector</CODE> component to build a custom search <CODE>url</CODE> to support the drill down behavior. The other gotcha was creating <STRONG>event types</STRONG> for each join duration type so that the drill down could filter by the proper bucket.</P> <P>After removing the default <CODE>ConvertToDrilldownSearch</CODE> module, here is the stub of the <CODE>Redirector</CODE>:</P> <PRE> <MODULE name="FlashChart"> <MODULE name="Redirector"> <OBJECT><PARAM name="popup" />True <PARAM name="url" />flashtimeline <PARAM name="arg.q" />search index="myIndex" host=myHost username="$click.value$" eventtype="#$click.name2$" | stats values(cs_uri_stem) as "Pages Accessed", count as "[Pages Viewed $click.name2$]" by username" </OBJECT></MODULE> </MODULE> </PRE> <P>The biggest let down of using the splunk markup is that their is no easy way to do conditionals inside a param - or performing an inline evaluation. Maybe this is just my lack of know-how. I've also learned that <CODE>ConvertToIntention</CODE> is completely useless when you need complete control over the search query (<EM>e.g. q=search index=myIndex</EM>). Stick with SideView Utils <CODE>Redirector</CODE> if you need complete search query control.</P> Wed, 07 Nov 2012 07:08:20 GMT https://community.splunk.com/t5/Splunk-Search/Drilldown-not-working-with-Join-Command/m-p/21547#M3541 slierninja 2012-11-07T07:08:20Z