how to customize drilldown options in form search?

[dianbo_1]

Hi,

I want to customize a form search as it described in http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown. It has a input text element "username" in the form, and after clicking the ">" button, it gererates a table. Then, i want to add a "HiddenSearch" module between "SimpleResultsTable" and "ConvertToDrilldownSearch" to customize the drilldown search. In "HiddenSearch", i use $username$ to define its search parameter. But the value i input in the text box can not be transferred to this internal "HiddenSearch". Can anyone give me some suggestions about this?

Thanks,

Dianbo

[sideview]

Since you're re-specifying the hidden search with the stringreplace token in it, you have to re-convert the stringreplace intention to fill it in again.

a lister pattern is basically a 2-module pattern where there's some UI module above with several params on it, one of which is settingToCreate, and then there's always a ConvertToIntention below that has the same value in its settingToConvert param.

What happens is that intentions are consumed whenever a search is kicked off. So the intention created by the ConvertToIntention was consumed when the search was kicked off to populate your table.

If you put a second copy of the ConvertToIntention below the table, then you can do the replacement a second time so it can be replaced in the second search.

( background: although its a bit unintuitive, the reason why we dont let the intentions stick around (and thus why we make the view developer reconvert them) is because in moderately complex drilldown cases you often need the outer intentions to NOT apply to internal searches at all. And adding a mechanism to surgically remove some of the existing intentions seemed trickier than having a convention where you require reconverting them.)