Dashboards & Visualizations

to pipe or add search string after drilling down of SimpleResultsTable

Contributor

Hi there

Is it possible to pipe or add search string of original search after drilling down of SimpleResultsTable? When drill down SimpleResultsTable it appends first column key-value at the end of original search, but i also want to pipe to filter out unwanted fields at the end

Thanks a lot

Tags (2)

Splunk Employee
Splunk Employee

Yes, but you will need to convert your view to Advanced XML and replace the "HiddenSearch" (or "HiddenSavedSearch") element with something like this:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="A drilldown example" autoRun="True">
    <param name="search">index=_internal | head 1000 | stats count by sourcetype</param>
    <param name="groupLabel">A drilldown example</param>
        <module name="HiddenFieldPicker">
            <param name="strictMode">True</param>
            <module name="JobProgressIndicator">
                <module name="EnablePreview">
                    <param name="enable">True</param>
                    <param name="display">False</param>
                    <module name="HiddenChartFormatter">
                        <module name="FlashChart">
                            <param name="width">100%</param>
                            <module name="HiddenSearch">
                                <!-- THIS IS THE DRILLDOWN SEARCH. REFERENCE $clickvalue$ as part of this search!! -->
                                <param name="search">index=_internal sourcetype=$clickvalue$ | fields host, sourcetype, source</param>
                                <module name="ConvertToIntention">
                                    <param name="intention">
                                        <param name="name">stringreplace</param>
                                        <param name="arg">
                                            <!-- THE VALUE OF name ATTRIBUTE IS THE NAME OF THE ATTRIBUTE YOU ASSIGN IN THE DRILLDOWN SEARCH ABOVE -->
                                            <param name="clickvalue">
                                                <param name="value">$click.value$</param>
                                            </param>
                                        </param>
                                    </param>
                                    <module name="JobProgressIndicator">
                                        <module name="StaticContentSample" layoutPanel="panel_row1_col1">
                                            <param name="text">EntityID</param>
                                            <module name="SimpleResultsHeader">
                                                <!-- THIS IS THE HEADER OF THE DRILLED-DOWN SEARCH PANEL. IF YOU WANT, YOU CAN REFERENCE ANY OF THE CLICK PROPERTIES ($click.name$, $click.value$,  $click.name2$ or $click.value2$) -->
                                                <param name="headerFormat">Drilldown $click.value$</param>
                                                <param name="entityName">events</param>
                                            </module>
                                            <module name="SimpleResultsTable">
                                                <param name="displayRowNumbers">False</param>
                                                <param name="entityName">events</param>
                                                <param name="drilldown">all</param>
                                            </module>
                                        </module>
                                    </module>
                                </module>

                            </module>
                        </module>
                        <module name="ViewRedirectorLink">
                            <param name="viewTarget">flashtimeline</param>
                        </module>
                    </module>
                </module>
            </module>
    </module>
</module>
0 Karma