Dashboards & Visualizations

Drilldown with stringreplace intention?

erydberg
Splunk Employee
Splunk Employee

I would like to specify a drilldown with a stringreplace intention. I'm trying to do something like this, but can't get it to work. What am I missing? The first two arguments comes from two drop down lists, and the outer table renders fine. The problem is when i click on a row in my table, then the search doesn't return any results and the jobs manager shows a job with the literals "$arg1$", "$arg2$" and "$arg3$" in it, instead of replacing them with their values.

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group Name">
                    <param name="search">`my_first_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <param name="settingToCreate">arg3_setting</param>
                            <param name="applyOuterIntentionsToInternalSearch">True</param>
                            <module name="ConvertToIntention">
                                <param name="preserveParentIntentions">True</param> 
                                <param name="settingToConvert">arg3_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg3">
                                            <param name="value">$click.value$</param>
                                        </param>
                                    </param>
                                </param>
                            <module name="HiddenSearch">
                                    <param name="search">`my_second_macro($arg1$, $arg2$, $arg3$)`</param>
                                    <module name="JobProgressIndicator"/>
                                    <module name="ResultsHeader">
                                        <param name="entityName">scanned</param>
                                        <param name="entityLabel">Events</param>
                                    </module>
                                    <module name="HiddenChartFormatter">
                                        <param name="chart">line</param>
                                        <module name="FlashChart">
                                            <param name="width">100%</param>                                            </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

Thanks!

Tags (2)
0 Karma
1 Solution

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

View solution in original post

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...