Dashboards & Visualizations

Drilldown with stringreplace intention?

erydberg
Splunk Employee
Splunk Employee

I would like to specify a drilldown with a stringreplace intention. I'm trying to do something like this, but can't get it to work. What am I missing? The first two arguments comes from two drop down lists, and the outer table renders fine. The problem is when i click on a row in my table, then the search doesn't return any results and the jobs manager shows a job with the literals "$arg1$", "$arg2$" and "$arg3$" in it, instead of replacing them with their values.

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group Name">
                    <param name="search">`my_first_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <param name="settingToCreate">arg3_setting</param>
                            <param name="applyOuterIntentionsToInternalSearch">True</param>
                            <module name="ConvertToIntention">
                                <param name="preserveParentIntentions">True</param> 
                                <param name="settingToConvert">arg3_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg3">
                                            <param name="value">$click.value$</param>
                                        </param>
                                    </param>
                                </param>
                            <module name="HiddenSearch">
                                    <param name="search">`my_second_macro($arg1$, $arg2$, $arg3$)`</param>
                                    <module name="JobProgressIndicator"/>
                                    <module name="ResultsHeader">
                                        <param name="entityName">scanned</param>
                                        <param name="entityLabel">Events</param>
                                    </module>
                                    <module name="HiddenChartFormatter">
                                        <param name="chart">line</param>
                                        <module name="FlashChart">
                                            <param name="width">100%</param>                                            </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

Thanks!

Tags (2)
0 Karma
1 Solution

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

View solution in original post

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Build resilience for the agentic era: Join us at Splunk Go San Jose

AI is changing how organizations build, operate, and secure digital services. As teams adopt AI agents and ...

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...