Dashboards & Visualizations

What am I missing for ConvertToIntention child module?

appleman
Contributor

ダッシュボードで、テーブルの値をクリックすると、その値に沿ったサーチ結果をその下のグラフに表示させたいのですが、下記エラー"This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error."が発生してしまいます。child moduleとして何が足りないのかご教授お願い致します。


Hello,

I'm trying to create a dashboard with "click.value". When you click the result on the table, it will drill down to the column graph. However, an error which is ""This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error." came out as a result.
I want to know what exactly I should configure as its child module.

Thank you.







1
False


splunk.search.job
1
True


dashboard









Enter number

stringreplace


True




Search
True
True
True

now
aaa
source=
| stats count by enrolled_date

| join [search earliest=-24h@h latest=now index=star $term$]
| stats max(enrolled_date) as enrolled count by product serial
| table enrolled
| eval enrolled=strftime(enrolled,"%c")
-7d@d


count
displayRowNumbers
beforeLabel


True


Enrolled Date







now
bbb
source=*info $term$
| stats max(lastmodified) as lastmodified
| eval lastmodified=strftime(lastmodified,"%c")
-24h@h


count
displayRowNumbers
beforeLabel


True


Lastmodified







now
ccc
source=*db_info $term$
| stats values(user) as user values(product) as product values(serial) as serial values(model) as model values(version) as version values(ip) as ip values(status) as status by id
-24h@h


count


True


20
results

False
True

row
results
20
True


results
id=$click.value$ $time$

  <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="False">
    <param name="search">source=push OR source=access | timechart count by source</param>

    <module name="ConvertToIntention">
       <param name="intention">
           <param name="name">addterm</param>
           <param name="arg">
               <param name="series">$click.value$</param>
           </param>
           <param name="fullName">$click.value$</param>

        <module name="JobProgressIndicator">
            <module name="HiddenChartFormatter">
              <param name="charting.chart">column</param>
              <module name="JSChart">
                <param name="width">100%</param>
                <module name="Gimp"/>
            </module>
          </module>
        </module>
       </param>
      </module>
    </module>
  </module>
</module>







0 Karma

melonman
Motivator

If you are using Splunk6, then you should go with simple XML with JavaScript extention.
There is a example of what you are looking for.

Install Splunk 6 Dashboard Examples app from splunk apps page:
http://apps.splunk.com/app/1603/

You can take a look at the following site:
http://localhost:8000/ja-JP/app/simple_xml_examples/custom_drilldown_form

There is a code sample, so you can actually copy&paste then edit to fit your need.

0 Karma

appleman
Contributor

Is it the same if I'm using SPlunk5?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...