pass more than one value to drill down chart

[spatil]

Hi ,

I have a drill down chart , which is getting filtered as per value clicked by user. Using below xml for the same.

<module name="ConvertToIntention">
  <param name="intention">
    <param name="name">addterm</param>
    <param name="arg">
    <param name="host">$click.value$</param>
    </param>
  </param>

Now, I need to filter drill down chart using both $click.value$ as well as selected value from drop down field. I can get selected value from drop down using $percentage$. How can I use this $percentage$ to filter the drill down chart ?

regards, S.

[Ant1D]

<module name="HiddenSearch"  autoRun="True">
    <!--search template for drill down chart-->
    <param name="search">index="myindex" |  timechart max(Usage_MB) by mount_points</param>
<module name="ConvertToIntention">
    <param name="settingToConvert">percentage_setting</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
             <param name="percentageUsage">
                 <param name="fillOnEmpty">True</param>
                 <param name="value">$target$</param>
             </param>
        </param>
    </param>
    <module name="ConvertToIntention">
        <param name="intention">
             <param name="name">addterm</param>
             <param name="arg">
                  <param name="host">$click.value$</param>
             </param>
        </param>
      ...charting tags for drill down chart
    </module> <!-- end of ConvertToIntention-->
</module> <!-- end of ConvertToIntention-->

Maybe this is what you are looking for.

[Ant1D]

Hi, I have tweaked the code. Where it says param name=value, I have changed the value from $percentage$ to $target$. This might help.

[spatil]

thanks adaniel , but It is still not working. Now it is showing some results in drill down chart, but does not show any change when different percentage is selected from drop down.

[Ant1D]

based on the code above, it should add host=chart_value_clicked and percentageUsage=the_field_for_percentages to your search index="myindex"...

[Ant1D]

I have changed the code in my answer. Maybe it will help.

[spatil]

thanks for ur reply, I tried above xml , but it is not showing any result. showing "no result found"

[spatil]

I created new addterm intension using another ConvertToIntension module, still It is not filtering drill down chart for $percentage$

below is the part of xml for view

<module name="HiddenSearch"  autoRun="True">
    <!--search template for drill down chart-->
    <param name="search">index="myindex" |  timechart max(Usage_MB) by mount_points</param>
<module name="ConvertToIntention">
  <param name="intention">
  <param name="name">addterm</param>
  <param name="arg">
    <param name="host">$click.value$</param>
  </param>
  </param>
  <module name="ConvertToIntention">
  <param name="intention">
  <param name="name">addtermlt</param>
  <param name="arg">
    <param name="percentageUsage">$percentage$</param>
  </param>
  </param>
  ...charting tags for drill down chart
  </module> <!-- end of addterm $percentage$-->
  </module> <!-- end of addterm $click.value$-->
  ...
  </module> <!--end os hidden search for drill down chart-->

Can any one point out the mistake here ? regards, S.

[sideview]

You have to turn the $percentage$ into an intention, much like you turned $click.value$ into an addterm intention.

A) If you want the percentage to be a plain old searchterm like $click.value$ was, you can just use create another addterm intention (using another ConvertToIntention).

B) If you want it to turn into a searchterm like percentage>40, that would be the addtermgt intention. Likewise with the addtermlt intention. Mileage may vary as these dont get used very often.

C) If the percentage field is destined for something more complicated than becoming a simple searchterm, you'll have to use the 'stringreplace' intention. The UI Examples app on SplunkBase has some examples of stringreplace syntax, if you havent read through them already. And with the stringreplace intention has to get plugged into some 'search', so you also leave a little $percentage$ token in the search param of the HiddenSearch module.

Since you're using addterm, my guess is that you probably dont have a HiddenSearch module between the first FlashChart and the second; with addterm you generally dont need one. So you might need to insert one in there to capture the $percentage$.

D) If you happen to be using the modules in sideview_utils, the story there is similar but simpler. In that system the UI values like $percentage$ just plug in directly to a Search module and there's no intervening step where you have to convert anything to an intention.