DrillDown Table

[pero1234]

How to put | search splunk_web_service="574.357430" before | rex command in drilldown table?

I mean, after click on value in drilldown table I want search like:

index=test sourcetype="test" splunk_web_service="574.357430" | rex ....

[sideview · Accepted solution]

If you're using the advanced XML, (and I gather from the nature of your quesstion that you're using the 'addterm' intention), then you can add an 'indexed' flag to the intention

Intention syntax is ugly, but here's an addterm intention that adds myField="myValue", and note the last line -- that directive tells the intention system not to try and be clever, but to put the given term in the first search clause always.

<param name="intention">
  <param name="name">addterm</param>
  <param name="arg">
    <param name="myField">myValue</param>
  </param>   
  <param name="flags"><list>indexed</list></param>
</param>

[sideview]

yes it is possible. Lots of things get simpler with Sideview Utils. Pulldown and TextField are far simpler to use compared to SearchSelectLister, StaticSelect, ExtendedFieldSearch and ConvertToIntention, and their arguments are plugged into the search using a simple $foo$ replacement facility on the Sideview Search module. There are a lot of docs and examples in Sideview Utils itself that will walk you through from simple cases. http://sideviewapps.com/apps/sideview-utils

[0waste_splunk]

is this possible in sideview utils? without intention?