Dashboards & Visualizations

PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command (can't drill down in redirected flashtimeline)

the_wolverine
Champion

I've seen numerous variations of this ERROR in Answers and wanted to post a specific one. I use a query that combines subsearch, eval and duration to generate a dashboard chart.

When a user clicks on the chart, the resulting flashtimeline looks great. However, clicking on any results from the flashtimeline fail (return nothing.)

I realize there is some trick to getting this to work, perhaps with ConvertToIntention but I'm failing to get it to work. My dashboard started as Simple XML and was converted to Advanced XML using the ?showsource=1 trick. I suspect there is some ugliness in the syntax I have from showsource with respect to properly modifying it to get ConvertToIntention to work properly.

therealdpk
Path Finder

This one caught me too. This solution makes the click work:

http://splunk-base.splunk.com/answers/60224/parser-applying-intentions-failed-unable-to-drilldown-be...

Specifically, add "table" to the end of the HiddenPostProcess search, with a list of fields you want to display. This may not be all you need (my use requires some additional work because one of the fields is obtained from max(_time), and the result of that changes between display and click), but it solves the specific problem.

cphair
Builder

I coded my dashboard from scratch and have the same problem. I opened a support case for it.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...