ConvertToDrillDownSearch

[Nerz]

I have a slight quandary with the ConvertToDrillDownSearch:

I have a summarised graph of the data i want on a specific sourcetype, I wish to click on this summary and drill down onto another sourcetype with the raw data in.

Can you drilldown to the flashtimeline and change the search to be that of another index/sourcetype , can this be done with a Hiddensaved Search?

here is an example of what i have:

[sideview · Accepted solution]

You're using Sideview Utils only to get the $search.timeRange.earliest$ keys, but not for anything else, which is very unusual. It means that you're really not taking advantage of any of the Sideview Utils benefits.

However, if you're only using the older 1.3.X versions of Sideview Utils, then this makes sense because the JSChart module was not patched yet back then.

Anyway, here's a version of your view where I've removed the Splunk modules HiddenSearch, ConvertToIntention and ViewRedirector modules and replaced them with a single Sideview Redirector module.

<module name="TimeRangePicker"> layoutPanel="panel_row3_col2">
  <param name="searchWhenChanged">true</param>

  <module name="Search">
    <param name="search"> index=generic sourcetype=generic_results_summary | timechart sum(generic_value) by generic_name

     <module name="HiddenChartFormatter">
      <param name="chart">line</param>
      <param name="chart.nullValueMode">zero</param>

      <module name="JSchart">
        <param name="enableresize">false</param>
        <param name="height">400px</param>
        <param name="maxResultCount">5000</param>
        <param name="width">100%</param>

        <module name="Redirector">
          <param name="url">flashtimeline</param>
          <param name="arg.earliest">$search.timeRange.earliest$</param>
          <param name="arg.latest">$search.timeRange.latest$</param>
          <param name="arg.q">search index=generic sourcetype="generic_results_raw" $click.searchTerms$</param>
        </module>
      </module>
    </module>
  </module>
</module>

I also added some linebreaks to make it easier to read. So a 30 line chunk of XML is now only 22 lines.

Note however that this relies on features in Sideview Utils that are only in Sideview Utils 2.1+. So get the latest version (2.2.2) from the Sideview site ( http://sideviewapps.com )

[Nerz]

hi all,
I found my solution i hope this helps someone else!

layoutpanel="panel_row3_col2">