Dashboards & Visualizations

Drilldown with stringreplace intention?

erydberg
Splunk Employee
Splunk Employee

I would like to specify a drilldown with a stringreplace intention. I'm trying to do something like this, but can't get it to work. What am I missing? The first two arguments comes from two drop down lists, and the outer table renders fine. The problem is when i click on a row in my table, then the search doesn't return any results and the jobs manager shows a job with the literals "$arg1$", "$arg2$" and "$arg3$" in it, instead of replacing them with their values.

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group Name">
                    <param name="search">`my_first_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <param name="settingToCreate">arg3_setting</param>
                            <param name="applyOuterIntentionsToInternalSearch">True</param>
                            <module name="ConvertToIntention">
                                <param name="preserveParentIntentions">True</param> 
                                <param name="settingToConvert">arg3_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg3">
                                            <param name="value">$click.value$</param>
                                        </param>
                                    </param>
                                </param>
                            <module name="HiddenSearch">
                                    <param name="search">`my_second_macro($arg1$, $arg2$, $arg3$)`</param>
                                    <module name="JobProgressIndicator"/>
                                    <module name="ResultsHeader">
                                        <param name="entityName">scanned</param>
                                        <param name="entityLabel">Events</param>
                                    </module>
                                    <module name="HiddenChartFormatter">
                                        <param name="chart">line</param>
                                        <module name="FlashChart">
                                            <param name="width">100%</param>                                            </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

Thanks!

Tags (2)
0 Karma
1 Solution

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

View solution in original post

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...