advanced xml syntax for a table of data, not a chart?

[dang]

I've been playing around with advanced xml to create a view with a time picker. I have figured out what I need to do to add charts of data, but how do I add a table of information from a search that uses a chart?

[David]

The easiest way to figure this out is to steal it from something already existing. For example, you can look at http://YourInstance:8000/en-US/app/search/search_status?showsource=1

If you scroll down to Common Searches, you'll see the following syntax:

<module name="SimpleResultsTable">
  <param name="drilldown">row</param>
  <param name="allowTransformedFieldSelect">True</param>
  <module name="ConvertToDrilldownSearch">
    <module name="ViewRedirector">
      <param name="viewTarget">flashtimeline</param>
    </module>
  </module>
</module>

Which should get you what you're looking for.

[David]

Excellent. Check out this Answers as well, for tips on clearing out the showsource=1 unnecessary things. (Like allowTransformedFieldSelect)

http://splunk-base.splunk.com/answers/11844/schedule-pdf-disabled-for-timerangepicker

[dang]

The ?showsource=1 tip was very useful, and I've now got it working. Thanks.

[dang]

So, If I'm currently using

[sideview]

It's extremely unlikely that you want that 'allowTransformedFieldSelect' param in there - that's detritus carried over from some long-ago simplified-xml conversion.