to pipe or add search string after drilling down of SimpleResultsTable

[hjwang]

Hi there

Is it possible to pipe or add search string of original search after drilling down of SimpleResultsTable? When drill down SimpleResultsTable it appends first column key-value at the end of original search, but i also want to pipe to filter out unwanted fields at the end

Thanks a lot

[ayme]

Yes, but you will need to convert your view to Advanced XML and replace the "HiddenSearch" (or "HiddenSavedSearch") element with something like this:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="A drilldown example" autoRun="True">
    <param name="search">index=_internal | head 1000 | stats count by sourcetype</param>
    <param name="groupLabel">A drilldown example</param>
        <module name="HiddenFieldPicker">
            <param name="strictMode">True</param>
            <module name="JobProgressIndicator">
                <module name="EnablePreview">
                    <param name="enable">True</param>
                    <param name="display">False</param>
                    <module name="HiddenChartFormatter">
                        <module name="FlashChart">
                            <param name="width">100%</param>
                            <module name="HiddenSearch">
                                <!-- THIS IS THE DRILLDOWN SEARCH. REFERENCE $clickvalue$ as part of this search!! -->
                                <param name="search">index=_internal sourcetype=$clickvalue$ | fields host, sourcetype, source</param>
                                <module name="ConvertToIntention">
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <!-- THE VALUE OF name ATTRIBUTE IS THE NAME OF THE ATTRIBUTE YOU ASSIGN IN THE DRILLDOWN SEARCH ABOVE -->
                                            <param name="clickvalue">
                                                <param name="value">$click.value$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="JobProgressIndicator">
                                        <module name="StaticContentSample" layoutPanel="panel_row1_col1">
                                            <param name="text">EntityID</param>
                                            <module name="SimpleResultsHeader">
                                                <!-- THIS IS THE HEADER OF THE DRILLED-DOWN SEARCH PANEL. IF YOU WANT, YOU CAN REFERENCE ANY OF THE CLICK PROPERTIES ($click.name$, $click.value$,  $click.name2$ or $click.value2$) -->
                                                <param name="headerFormat">Drilldown $click.value$</param>
                                                <param name="entityName">events</param>
                                            </module>
                                            <module name="SimpleResultsTable">
                                                <param name="displayRowNumbers">False</param>
                                                <param name="entityName">events</param>
                                                <param name="drilldown">all</param>
                                            </module>
                                        </module>
                                    </module>
                                </module>

                            </module>
                        </module>
                        <module name="ViewRedirectorLink">
                            <param name="viewTarget">flashtimeline</param>
                        </module>
                    </module>
                </module>
            </module>
    </module>
</module>