I have a dashboard using some form fields/tokens to populate a few things(charts).(their "hiddenSearch" modules)
I have a HiddenSearch -> ... -> SimpleResultsTable ... with a param of drilldown=all. This hiddensearch is using tokens from the form above in its searchstring.
The goal is to have... when selecting a cell in the table have it open the flashtimeline with that kv pair in the search string... this is not happening. Instead it is just passing the HiddenSearch... searchstring. (sorry a bit cryptic)
Point is...No matter what cell/row/col i click on it sends the same searchstring(the one from the hiddensearch module) to the flashtimeline. Not the kv pair from the cell.
thoughts?
TIA, Kirby
Sounds like you're already using the Advanced XML. Do you have a copy of the 4.1 ui_examples app? That app contains a large number of custom drilldown development examples. If you only have the old 4.0 version it wont have any examples of course.
At a guess it sounds like you dont have either a ConvertToDrilldownSearch module, or a ConvertToIntention module.
One way to get some understanding is to get a simplified dashboard, reconfigure a panel to use an 'inline search string', set the drilldown to 'cell' there in the simplified editing UI, and then follow these steps to convert to advanced XML.
http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard
The resulting advanced XML will work (although it has a couple chaff modules that you wont need like an unnecessary HiddenFieldPicker and ViewStateAdapter module) but comparing the two you might see something simple that you're missing.
Sounds like you're already using the Advanced XML. Do you have a copy of the 4.1 ui_examples app? That app contains a large number of custom drilldown development examples. If you only have the old 4.0 version it wont have any examples of course.
At a guess it sounds like you dont have either a ConvertToDrilldownSearch module, or a ConvertToIntention module.
One way to get some understanding is to get a simplified dashboard, reconfigure a panel to use an 'inline search string', set the drilldown to 'cell' there in the simplified editing UI, and then follow these steps to convert to advanced XML.
http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard
The resulting advanced XML will work (although it has a couple chaff modules that you wont need like an unnecessary HiddenFieldPicker and ViewStateAdapter module) but comparing the two you might see something simple that you're missing.
Actually, can you paste the exact search you're running into this question? the values(val1) values(val2) is very odd. Any reason you're not just getting a set of unique combinations with "stats count by val1 val2"
i posted a new question http://answers.splunk.com/questions/2555/drilldown-whilst-using-a-search-w-stats-values
I recreated it in the sample index. it looks like its related to the fact that the cell created is a stat value...
It also happens within the flashtimeline view. If i type in that query in the flashtimeline... and select a cell .. it opens a new window of the flashtimeline view with the root query (search string prior to the first pipe) ... again w/o the cell value selected.
When i select a cell in the table... it pushes entire hiddensearch search string with the tokens... instead of including the cell key=value. 😕
It's similar to 'index=summary_index val1=$val1token$ val2=$val2token | stats values(val1) as name1, values(val2) as name2 by name2 ... something to that extent. The dashboard is using an inverted flow ... form fields up top... click button... filter the resulting chart and graph below.
Hm. thats very odd. Can you paste in the search that is generating the data, as well as the XML from the SimpleResultsTable down?
I am using a SimpleResultsTable -> ConvertToDrilldownSearch -> ViewRedirector just like most all the examples.
i do have the ui_examples. and i like your approach to troubleshooting. I'll adopt that. Thanks again for the assistance. You're everywhere!