Dashboards & Visualizations

What am I missing for ConvertToIntention child module?

appleman
Contributor

ダッシュボードで、テーブルの値をクリックすると、その値に沿ったサーチ結果をその下のグラフに表示させたいのですが、下記エラー"This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error."が発生してしまいます。child moduleとして何が足りないのかご教授お願い致します。


Hello,

I'm trying to create a dashboard with "click.value". When you click the result on the table, it will drill down to the column graph. However, an error which is ""This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error." came out as a result.
I want to know what exactly I should configure as its child module.

Thank you.







1
False


splunk.search.job
1
True


dashboard









Enter number

stringreplace


True




Search
True
True
True

now
aaa
source=
| stats count by enrolled_date

| join [search earliest=-24h@h latest=now index=star $term$]
| stats max(enrolled_date) as enrolled count by product serial
| table enrolled
| eval enrolled=strftime(enrolled,"%c")
-7d@d


count
displayRowNumbers
beforeLabel


True


Enrolled Date







now
bbb
source=*info $term$
| stats max(lastmodified) as lastmodified
| eval lastmodified=strftime(lastmodified,"%c")
-24h@h


count
displayRowNumbers
beforeLabel


True


Lastmodified







now
ccc
source=*db_info $term$
| stats values(user) as user values(product) as product values(serial) as serial values(model) as model values(version) as version values(ip) as ip values(status) as status by id
-24h@h


count


True


20
results

False
True

row
results
20
True


results
id=$click.value$ $time$

  <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="False">
    <param name="search">source=push OR source=access | timechart count by source</param>

    <module name="ConvertToIntention">
       <param name="intention">
           <param name="name">addterm</param>
           <param name="arg">
               <param name="series">$click.value$</param>
           </param>
           <param name="fullName">$click.value$</param>

        <module name="JobProgressIndicator">
            <module name="HiddenChartFormatter">
              <param name="charting.chart">column</param>
              <module name="JSChart">
                <param name="width">100%</param>
                <module name="Gimp"/>
            </module>
          </module>
        </module>
       </param>
      </module>
    </module>
  </module>
</module>







0 Karma

melonman
Motivator

If you are using Splunk6, then you should go with simple XML with JavaScript extention.
There is a example of what you are looking for.

Install Splunk 6 Dashboard Examples app from splunk apps page:
http://apps.splunk.com/app/1603/

You can take a look at the following site:
http://localhost:8000/ja-JP/app/simple_xml_examples/custom_drilldown_form

There is a code sample, so you can actually copy&paste then edit to fit your need.

0 Karma

appleman
Contributor

Is it the same if I'm using SPlunk5?

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...