Dashboards & Visualizations

Drilldown with stringreplace intention?

erydberg
Splunk Employee
Splunk Employee

I would like to specify a drilldown with a stringreplace intention. I'm trying to do something like this, but can't get it to work. What am I missing? The first two arguments comes from two drop down lists, and the outer table renders fine. The problem is when i click on a row in my table, then the search doesn't return any results and the jobs manager shows a job with the literals "$arg1$", "$arg2$" and "$arg3$" in it, instead of replacing them with their values.

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group Name">
                    <param name="search">`my_first_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <param name="settingToCreate">arg3_setting</param>
                            <param name="applyOuterIntentionsToInternalSearch">True</param>
                            <module name="ConvertToIntention">
                                <param name="preserveParentIntentions">True</param> 
                                <param name="settingToConvert">arg3_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg3">
                                            <param name="value">$click.value$</param>
                                        </param>
                                    </param>
                                </param>
                            <module name="HiddenSearch">
                                    <param name="search">`my_second_macro($arg1$, $arg2$, $arg3$)`</param>
                                    <module name="JobProgressIndicator"/>
                                    <module name="ResultsHeader">
                                        <param name="entityName">scanned</param>
                                        <param name="entityLabel">Events</param>
                                    </module>
                                    <module name="HiddenChartFormatter">
                                        <param name="chart">line</param>
                                        <module name="FlashChart">
                                            <param name="width">100%</param>                                            </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

Thanks!

Tags (2)
0 Karma
1 Solution

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

View solution in original post

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...