Dashboards & Visualizations

What am I missing for ConvertToIntention child module?

Contributor

ダッシュボードで、テーブルの値をクリックすると、その値に沿ったサーチ結果をその下のグラフに表示させたいのですが、下記エラー"This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error."が発生してしまいます。child moduleとして何が足りないのかご教授お願い致します。


Hello,

I'm trying to create a dashboard with "click.value". When you click the result on the table, it will drill down to the column graph. However, an error which is ""This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error." came out as a result.
I want to know what exactly I should configure as its child module.

Thank you.







1
False


splunk.search.job
1
True


dashboard









Enter number

stringreplace


True




Search
True
True
True

now
aaa
source=
| stats count by enrolleddate

| join [search earliest=-24h@h latest=now index=star $term$]
| stats max(enrolled
date) as enrolled count by product serial
| table enrolled
| eval enrolled=strftime(enrolled,"%c")
-7d@d


count
displayRowNumbers
beforeLabel


True


Enrolled Date







now
bbb
source=info $term$
| stats max(lastmodified) as lastmodified
| eval lastmodified=strftime(lastmodified,"%c")
-24h@h


count
displayRowNumbers
beforeLabel


True


Lastmodified







now
ccc
source=db_info $term$
| stats values(user) as user values(product) as product values(serial) as serial values(model) as model values(version) as version values(ip) as ip values(status) as status by id
-24h@h


count


True


20
results

False
True

row
results
20
True


results
id=$click.value$ $time$

  <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="False">
    <param name="search">source=push OR source=access | timechart count by source</param>

    <module name="ConvertToIntention">
       <param name="intention">
           <param name="name">addterm</param>
           <param name="arg">
               <param name="series">$click.value$</param>
           </param>
           <param name="fullName">$click.value$</param>

        <module name="JobProgressIndicator">
            <module name="HiddenChartFormatter">
              <param name="charting.chart">column</param>
              <module name="JSChart">
                <param name="width">100%</param>
                <module name="Gimp"/>
            </module>
          </module>
        </module>
       </param>
      </module>
    </module>
  </module>
</module>







0 Karma

Motivator

If you are using Splunk6, then you should go with simple XML with JavaScript extention.
There is a example of what you are looking for.

Install Splunk 6 Dashboard Examples app from splunk apps page:
http://apps.splunk.com/app/1603/

You can take a look at the following site:
http://localhost:8000/ja-JP/app/simple_xml_examples/custom_drilldown_form

There is a code sample, so you can actually copy&paste then edit to fit your need.

0 Karma

Contributor

Is it the same if I'm using SPlunk5?

0 Karma