How to build a table module drilldown from one column in a table to a timechart?

[subtrakt]

Hi,

Any recommendations on how I should build out drill-down to a timechart sourced/linked from one column in a table?

1. The table column in the is testcolumn4.

2. The drilldown would be sourced from testfield10 in the hiddensavedsearch.

3. Drilldown To : index=index1 "testfield10" | timechart count by testfield10

4. Destination: http://testbox:8000/en-US/app/test1/search

   
   

[sideview]

So to recap, you have a table with a number of fields. One of these fields is "testcolumn4". You want the drilldown to basically pass only the value of this column. In your example the value is "testfield10".

And you want to send the user to the default search view and run a search that includes the value from the clicked-on row, "testfield10"?

If that's the case, here is sample XML to do that. I'm also passing the drilldown timerange for you, because that's a best practice. And I took the liberty of replacing some core Splunk modules with the newer Sideview equivalent.

<module name="SavedSearch"  layoutPanel="panel_row1_col1" group="test1" autoRun="True">
  <param name="useHistory">True</param>
  <param name="name">test1</param>
  <module name="JobProgressIndicator" />
  <module name="Export">
      <param name="exportType">results</param>
  </module>
  <module name="Pager">
    <module name="Table" >
      <module name="Redirector">
        <param name="url">search</param>
        <param name="arg.q">index=index1 $row.fields.testcolumn4$ | timechart count by testfield10</param>
        <param name="arg.earliest">$search.timeRange.earliest$</param>
        <param name="arg.latest">$search.timeRange.latest$</param>
      </module>
    </module>
  </module>