How can I create a report which uses an Accelerated Search and uses Intentions

[anthonycopus]

Hi,

At the moment I'm trying to get a report to run using an accelerated search, but I need to add in both a post process and an intention which set the time bucket. Currently I have as seen below:

    <module name="TimeRangePicker">
        <param name="searchWhenChanged">True</param>
        <param name="label">Time Range:</param>
        <param name="selected">Last 7 days</param>
        <module name="StaticSelect">
            <param name="settingToCreate">span_setting</param>
            <param name="label">Bin Span:</param>
            <param name="searchWhenChanged">True</param>
            <param name="selected">Daily</param>
            <param name="staticFieldsToDisplay">
                <list>
                    <param name="value">1h</param>
                    <param name="label">Hourly</param>
                </list>
                <list>
                    <param name="value">1d</param>
                    <param name="label">Daily</param>
                    </list>
            </param>
            <module name="ConvertToIntention">
                <param name="settingToConvert">span_setting</param>
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="span_search">
                           <param>name="fillOnEmpty">True</param>
                           <param>name="value">$target$</param>
                        </param>
                    </param>
                </param>
                <module autoRun="True" group="User Log" layoutPanel="panel_row1_col1" name="HiddenSavedSearch">
                    <param name="savedSearch">logs_accelerated</param>
                    <param name="groupLabel">Log</param>
                    <module name="HiddenPostProcess">
                        <param name="search">search | timechart sum(count) AS Count</param>

Ideally, I would want the HiddenPostProcess to have:

| timechart $span_search$ sum(Count) AS Count

However, I'm aware that intentions can't be added to HiddenPostProcesses. Altering the savedsearch to a normal search which uses the saved search followed by the intention isn't allowing use of the acceleration (as I can see by the count in the report acceleration summary).

Is there a way around this so I can use an accelerated search to create a timechart and allow the time bucket to be selected without using Sideview Utils?

[sideview]

You have an autoRun="True" way down in your XML instead of up at the top of the tree. It may be causing no harm but I doubt it. Move that all the way up to the topmost module before doing anything else. I doubt it's causing this problem but it may well be causing confusion of some kind.

From your XML it seems clear that you want the intention's "span" argument to apply to the timechart in HiddenPostProcess? That cannot be done - Splunk's HiddenPostProcess module doesn't work either with intentions or with raw $foo$ tokens.

Fortunately if you did switch to Sideview Utils, this view would get a bit simpler.

<module name="TimeRangePicker" autoRun="True">
    <param name="searchWhenChanged">True</param>
    <param name="label">Time Range:</param>
    <param name="selected">Last 7 days</param>

    <module name="Pulldown">
        <param name="name">span</param>
        <param name="label">Bin Span:</param>
        <param name="staticOptions">
            <list>
                <param name="value">1h</param>
                <param name="label">Hourly</param>
            </list>
            <list>
                <param name="value">1d</param>
                <param name="label">Daily</param>
                </list>
        </param>

        <module name="SavedSearch" group="User Log" layoutPanel="panel_row1_col1">
            <param name="savedSearch">logs_accelerated</param>
            <module name="PostProcess">
                <param name="search">| timechart $span$sum(count) AS Count</param>

That said, if that saved search is saved with acceleration, and if your span_setting intention as written is not matching some $foo$ token in the base search (it would be very strange and nonsensical to have a $foo$ token in a saved search btw), then I'm not sure why the acceleration isn't taking affect - other problems with postprocess/intentions aside.