Drilldown problem

[radomo]

I have a problem with the drilldown in a advanced views.

I have this module and the problem that use a variable as you can view with the name fechaConsulta, in the first query no problem, but splunk don´t change the value in the second query.

Any Idea?

 <module name="HiddenSearch" layoutPanel="panel_row2_col2" autoRun="False">
    <param name="search">| savedsearch myquery2 fechaConsulta="$fechaConsulta$"<\/param>
    <param name="earliest">-1h<\/param>
    <module name="HiddenChartFormatter">
      <param name="legend.placement">none<\/param>
      <module name="JobProgressIndicator"\/>
      <module name="SimpleResultsTable">
        <param name="drilldown">row<\/param>
        <param name="entityName">results<\/param>
        <param name="displayRowNumbers">false<\/param>
       <module name="SimpleResultsHeader">
          <param name="entityName">results<\/param>
          <param name="headerFormat">Second Chart<\/param>
        <\/module> 
        <module name="HiddenSearch">
        <param name="search">| dbquery Dreivip limit=1000 "select DATE_FORMAT(en.fechaExpedicion,'%d-%m-%Y') as fecha, dato as Myfield from mytable en WHERE DATE(en.fechaExpedicion) BETWEEN DATE(STR_TO_DATE('$fechaConsulta$','%d-%m-%Y') - INTERVAL 3 DAY) AND STR_TO_DATE('$fechaConsulta$','%d-%m-%Y') \nGROUP BY en.fechaExpedicion" | table fecha, * | addtotals fieldname="TOTAL DIA" *<\/param>
        <param name="groupLabel">Carga<\/param>
        <param name="earliest">-4h@m<\/param>
        <param name="latest">now<\/param>
        <module name="ViewstateAdapter">
          <module name="HiddenFieldPicker">
            <param name="strictMode">True<\/param>
            <module name="JobProgressIndicator">
              <module name="EnablePreview">
                <param name="enable">True<\/param>
                <param name="display">False<\/param>
                <module name="HiddenChartFormatter">
                  <param name="charting.chart">line<\/param>
                  <module name="JSChart">
                    <param name="width">100%<\/param>
                    <module name="Gimp"\/>
                    <module name="ConvertToDrilldownSearch">
                      <module name="ViewRedirector">
                        <param name="viewTarget">flashtimeline <\/ param>
                      <\/module>
                    <\/module>
                  <\/module>
                  <module name="ViewRedirectorLink">
                    <param name="viewTarget">flashtimeline<\/ param>
                  <\/module>
                <\/module>
              <\/module>
            <\/module>
          <\/module>
        <\/module>
      <\/module>
      <\/module>
    <\/module>    

[sideview]

With the core splunk modules you need to use intentions in here in order for selected form element values and click arguments from tables to make it into the drilldown searches. I think that is what you're missing here. That intention would be via the ConvertToIntention module and in this particular case you would have to embed a stringreplace intention. Intentions are very complicated though. If you really want to go that way the Dashboard Examples app has a couple examples of intentions.

What I recommend instead is using the modules that you get with Sideview Utils. Among other benefits it removes intentions from the picture. With this plus lots of other simplifications, your XML becomes simpler, shorter and more self-consistent.

I wrote a little converted version of your view below as an illustration. The docs for Sideview Utils are within the app itself so you can read more there.

Also, it looks like you had some weird hierarchy going on in your view - the header for your drilldown search was probably displaying row counts from the upper search, and there actually wasn't any $foo$ token or anything in the drilldown search that was trying to pick up a drilldown argument. With SimpleResultsTable you'd need both $click.value$ and a stringreplace intention, but with Sideview Utils you can just put $click.fields.someFieldName$ right into the Search module. I left some comments in the XML for you. I hope this helps.

<!-- you need to put the SideviewUtils module somewhere. Usually at the top of the file out of the way -->
<module name="SideviewUtils" layoutPanel="navigationHeader" />

<module name="Search" layoutPanel="panel_row2_col2">
  <param name="search">| savedsearch myquery2 fechaConsulta="$fechaConsulta$"</param>
  <param name="earliest">-1h</param>

  <!-- you had two HiddenChartFormatters but I consolidated them into 1 ValueSetter. -->
  <module name="ValueSetter">
    <param name="arg.charting.legend.placement">none</param>
    <param name="arg.charting.chart">line</param>

    <module name="JobProgressIndicator"/>

    <!-- Table is both simpler to use and more powerful than SimpleResultsTable -->
    <module name="Table">

      <!-- I think you need to put in whatever field value you are using from the clicked 
      table row?    The Table module exposes this as $click.fields.*$, so for example if it was a username field you would put $click.fields.username$ somewhere in your search here -->
      <module name="Search">
        <param name="search">| dbquery Dreivip limit=1000 "select DATE_FORMAT(en.fechaExpedicion,'%d-%m-%Y') as fecha, dato as Myfield from mytable en WHERE DATE(en.fechaExpedicion) BETWEEN DATE(STR_TO_DATE('$fechaConsulta$','%d-%m-%Y') - INTERVAL 3 DAY) AND STR_TO_DATE('$fechaConsulta$','%d-%m-%Y') \nGROUP BY en.fechaExpedicion" | table fecha, * | addtotals fieldname="TOTAL DIA" *</param>
        <param name="earliest">-4h@m</param>
        <param name="latest">now</param>

        <module name="SimpleResultsHeader">
          <param name="entityName">results</param>
          <param name="headerFormat">Second Chart</param>
        </module> 
        <module name="JobProgressIndicator" />
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
        </module>

        <module name="JSChart">
          <param name="width">100%</param>
          <module name="ConvertToDrilldownSearch">
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline </param>
            </module>
          </module>
        </module>
        <module name="ViewRedirectorLink">
          <param name="viewTarget">flashtimeline</param>
        </module>

      </module>
    </module>
  </module>
</module>

Also don't ever use autoRun="False". It doesn't do anything besides confuse you. Have only one autoRun="True" at the top, ever, and don't have any autoRun="False" anywhere.