Splunk Search
Highlighted

DrillDown Table

Path Finder

alt text

How to put | search splunk_web_service="574.357430" before | rex command in drilldown table?

I mean, after click on value in drilldown table I want search like:

index=test sourcetype="test" splunk_web_service="574.357430" | rex ....
Tags (2)
0 Karma
Highlighted

Re: DrillDown Table

SplunkTrust
SplunkTrust

If you're using the advanced XML, (and I gather from the nature of your quesstion that you're using the 'addterm' intention), then you can add an 'indexed' flag to the intention

Intention syntax is ugly, but here's an addterm intention that adds myField="myValue", and note the last line -- that directive tells the intention system not to try and be clever, but to put the given term in the first search clause always.

<param name="intention">
  <param name="name">addterm</param>
  <param name="arg">
    <param name="myField">myValue</param>
  </param>   
  <param name="flags"><list>indexed</list></param>
</param>

View solution in original post

Highlighted

Re: DrillDown Table

Communicator

is this possible in sideview utils? without intention?

0 Karma
Highlighted

Re: DrillDown Table

SplunkTrust
SplunkTrust

yes it is possible. Lots of things get simpler with Sideview Utils. Pulldown and TextField are far simpler to use compared to SearchSelectLister, StaticSelect, ExtendedFieldSearch and ConvertToIntention, and their arguments are plugged into the search using a simple $foo$ replacement facility on the Sideview Search module. There are a lot of docs and examples in Sideview Utils itself that will walk you through from simple cases. http://sideviewapps.com/apps/sideview-utils

0 Karma