Dashboards & Visualizations

Drilldown with stringreplace intention?

erydberg
Splunk Employee
Splunk Employee

I would like to specify a drilldown with a stringreplace intention. I'm trying to do something like this, but can't get it to work. What am I missing? The first two arguments comes from two drop down lists, and the outer table renders fine. The problem is when i click on a row in my table, then the search doesn't return any results and the jobs manager shows a job with the literals "$arg1$", "$arg2$" and "$arg3$" in it, instead of replacing them with their values.

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group Name">
                    <param name="search">`my_first_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <param name="settingToCreate">arg3_setting</param>
                            <param name="applyOuterIntentionsToInternalSearch">True</param>
                            <module name="ConvertToIntention">
                                <param name="preserveParentIntentions">True</param> 
                                <param name="settingToConvert">arg3_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg3">
                                            <param name="value">$click.value$</param>
                                        </param>
                                    </param>
                                </param>
                            <module name="HiddenSearch">
                                    <param name="search">`my_second_macro($arg1$, $arg2$, $arg3$)`</param>
                                    <module name="JobProgressIndicator"/>
                                    <module name="ResultsHeader">
                                        <param name="entityName">scanned</param>
                                        <param name="entityLabel">Events</param>
                                    </module>
                                    <module name="HiddenChartFormatter">
                                        <param name="chart">line</param>
                                        <module name="FlashChart">
                                            <param name="width">100%</param>                                            </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

Thanks!

Tags (2)
0 Karma
1 Solution

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

View solution in original post

erydberg
Splunk Employee
Splunk Employee

The arguments from the listers were consumed in the first search, so they need to be converted again, which means that I need two more ConvertToIntention: (Also, the " <param name="settingToConvert">arg3_setting</param>" in the arg3 converter was not needed but caused that conversion to fail.) The working xml looks like:

                <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Group name">
                    <param name="search">`my_macro($arg1$, $arg2$)`</param>
                    <module name="ResultsHeader">
                        <param name="entityName">scanned</param>
                        <param name="entityLabel">Events</param>
                        <module name="SimpleResultsTable">
                            <param name="count">100</param>
                            <param name="displayMenu">True</param>
                            <param name="drilldown">row</param>
                            <module name="ConvertToIntention">
                                <param name="settingToConvert">arg1_setting</param>
                                <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                        <param name="arg1">
                                            <param name="value">$target$</param>
                                        </param>
                                    </param>
                                </param>
                                <module name="ConvertToIntention">
                                    <param name="settingToConvert">arg2_setting</param>
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <param name="arg2">
                                                <param name="value">$target$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="ConvertToIntention">
                                        <param name="intention">
                                            <param name="name">stringreplace</param>
                                            <param name="arg">
                                                <param name="arg3_file">
                                                    <param name="value">$click.value$</param>
                                                </param>
                                            </param>
                                        </param>
                                        <module name="HiddenSearch">
                                            <param name="search">`file_coverage($arg1$, $arg2$, $arg3$)`</param>
                                            <module name="JobProgressIndicator"/>
                                            <module name="ResultsHeader">
                                                <param name="entityName">scanned</param>
                                                <param name="entityLabel">Events</param>
                                            </module>
                                            <module name="HiddenChartFormatter">
                                                <param name="chart">line</param>
                                                <module name="FlashChart">
                                                    <param name="width">100%</param>
                                                </module>
                                            </module>
                                        </module>
                                    </module>
                                </module>
                            </module>
                        </module>
                    </module>
                </module>

View solution in original post