Dashboards & Visualizations

drilldown behavior for a simpleResultsTable not working

hiddenkirby
Contributor

I have a dashboard using some form fields/tokens to populate a few things(charts).(their "hiddenSearch" modules)

I have a HiddenSearch -> ... -> SimpleResultsTable ... with a param of drilldown=all. This hiddensearch is using tokens from the form above in its searchstring.

The goal is to have... when selecting a cell in the table have it open the flashtimeline with that kv pair in the search string... this is not happening. Instead it is just passing the HiddenSearch... searchstring. (sorry a bit cryptic)

Point is...No matter what cell/row/col i click on it sends the same searchstring(the one from the hiddensearch module) to the flashtimeline. Not the kv pair from the cell.

thoughts?

TIA, Kirby

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Sounds like you're already using the Advanced XML. Do you have a copy of the 4.1 ui_examples app? That app contains a large number of custom drilldown development examples. If you only have the old 4.0 version it wont have any examples of course.

At a guess it sounds like you dont have either a ConvertToDrilldownSearch module, or a ConvertToIntention module.

One way to get some understanding is to get a simplified dashboard, reconfigure a panel to use an 'inline search string', set the drilldown to 'cell' there in the simplified editing UI, and then follow these steps to convert to advanced XML.
http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard

The resulting advanced XML will work (although it has a couple chaff modules that you wont need like an unnecessary HiddenFieldPicker and ViewStateAdapter module) but comparing the two you might see something simple that you're missing.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Sounds like you're already using the Advanced XML. Do you have a copy of the 4.1 ui_examples app? That app contains a large number of custom drilldown development examples. If you only have the old 4.0 version it wont have any examples of course.

At a guess it sounds like you dont have either a ConvertToDrilldownSearch module, or a ConvertToIntention module.

One way to get some understanding is to get a simplified dashboard, reconfigure a panel to use an 'inline search string', set the drilldown to 'cell' there in the simplified editing UI, and then follow these steps to convert to advanced XML.
http://www.splunk.com/base/Documentation/latest/Developer/AdvancedDashboard

The resulting advanced XML will work (although it has a couple chaff modules that you wont need like an unnecessary HiddenFieldPicker and ViewStateAdapter module) but comparing the two you might see something simple that you're missing.

sideview
SplunkTrust
SplunkTrust

Actually, can you paste the exact search you're running into this question? the values(val1) values(val2) is very odd. Any reason you're not just getting a set of unique combinations with "stats count by val1 val2"

0 Karma

hiddenkirby
Contributor
0 Karma

hiddenkirby
Contributor

I recreated it in the sample index. it looks like its related to the fact that the cell created is a stat value...

0 Karma

hiddenkirby
Contributor

It also happens within the flashtimeline view. If i type in that query in the flashtimeline... and select a cell .. it opens a new window of the flashtimeline view with the root query (search string prior to the first pipe) ... again w/o the cell value selected.

0 Karma

hiddenkirby
Contributor

When i select a cell in the table... it pushes entire hiddensearch search string with the tokens... instead of including the cell key=value. 😕

0 Karma

hiddenkirby
Contributor

It's similar to 'index=summary_index val1=$val1token$ val2=$val2token | stats values(val1) as name1, values(val2) as name2 by name2 ... something to that extent. The dashboard is using an inverted flow ... form fields up top... click button... filter the resulting chart and graph below.

0 Karma

sideview
SplunkTrust
SplunkTrust

Hm. thats very odd. Can you paste in the search that is generating the data, as well as the XML from the SimpleResultsTable down?

0 Karma

hiddenkirby
Contributor

I am using a SimpleResultsTable -> ConvertToDrilldownSearch -> ViewRedirector just like most all the examples.

0 Karma

hiddenkirby
Contributor

i do have the ui_examples. and i like your approach to troubleshooting. I'll adopt that. Thanks again for the assistance. You're everywhere!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...