One may note that this can be achieved by a smart join after the first one (or by a where clause inside the join), but I do not want to do it like this, as the eval myEval is almost free (time wise), and adding more search argument inside the join performs way better (tested and the result are found 2* faster) than the join or where method. Thanks for your help ... View more

I have still to figure how to do it, but I have done some research and the main problem comes from the fact that the result of a field cannot be used as a parameter inside a search. for example I have this: index=test action | join [some search | eval myEval="some search result"] | join action [search index=test action myEval] I want to be able to replace the myEval key by it's value, but I still didn't found a way to do it. ... View more

Thanks for the answer, but when I try this I get a: "The job appears to have expired or has been canceled. Splunk could not retrieve data for this search." Or if I use eventstats instead of stats, I get a: "[EventsViewer module] Cannot access search data; job 1362647009.7159 is a zombie and is no longer with us" ... View more

Thanks for the insight. I was able to solve the problem. In fact it has nothing to do with the space or not (it just appears to reveal the problem). It was due to the fact that I need to double escape the quote in some case. Details in the answer below. ... View more

OK, that's maybe the best automated solution, I completely forgot about arguments in macro, thanks for finding out this one! ... View more

I am surprised no one ask for this before. Thanks for the answer. I will set up the lookup for bissextile year and post it when it's done. ... View more

Sorry -_-, I forgot to escape the backslashes ^^, so the page just show normal quotes. I edit it. The answer you have given is what I would expect too (putting a space or not between the \" and the " shouldn't matter, but somehow it does, at least in splunk 4.2 with sideview 2.2.8). ... View more

Thanks for the answer! I think I understand what you are suggesting here, but as I store the transaction, wouldn't I loose all the benefits of summary indexing, if I need to perform the sum+avg on all the transaction on the reporting side? I guess it will be faster than rerunning every time the transaction though. I will test this solution and see if it's suitable for the traffic we have. Guilhem PS: I cannot make the "timeline" display nicely for all browser, so I recommend looking at it using firefox ^^. ... View more

Perfect, using the current=f to get the last-but-one value is clever! I update the answer. ... View more

Be carefull thow, as I have just discovered, the lis() function only returns the first 100 results, so it may be convenient to use something else (penultimate duration value, instead of list). I will update the answer when I found out how to find the penultimate value of a field using stats. ... View more

Hum, I have just checked the transaction maxpause field, and in fact it will discard transaction with pauses that are greater that maxpause, it will not split them and make two transaction out of it, which is not really what I was thinking, anyway the problem still hold. ... View more

Thansk for your comment, I have corrected the typos (I was performing test and copy-pasted without checking what I have pasted) I will look again into this when I have some time. ... View more

Thanks for the tips, I have edited my answer accordingly, but there is still an (unsolvable?) problem due to the getContext() function I think. ... View more

Allright, after reading the DOCs again, and the detailed answer you wrote, I was able to put something together, which works very partially. So I have wrote this CustomBehavior module (the comments are not mine, I have just copy-pasted them): Sideview.utils.declareCustomBehavior("refreshOnlyOnce", function(pulldownModule) { var requiresDispatchReference = pulldownModule.requiresDispatch.bind(pulldownModule); /** * if the module is configured dynamically then we have to trigger * a new dispatched search. Note that we actually defer to * DispatchingModule to calculate it. */ pulldownModule.requiresDispatch = function() { var result; if (this.contextRefreshOnlyOnce != null) { result = false; } else { result = requiresDispatchReference(); this.contextRefreshOnlyOnce = this.getContext(); } return result; } /** * called when a module from downstream requests new context data */ pulldownModule.getModifiedContext = function() { if (this.contextRefreshOnlyOnce !=null) { context = this.contextRefreshOnlyOnce; } else { context = this.getContext(); } return context; } }); You need of course a contextRefreshOnlyOnce variable inside the application.js. The search is dispatched the first time, and never after, but the problem is, as one can expect, the downstream values are always the one that has been set on page load, which means that any modification from upstream will not affect downstream of this module. Additionaly, context values coming from static upstream pulldowns exists after this module, but for some reason "dynamic" context values (coming from resultsValueSetters after a search for example) does not. I am still investigating on how to be able to refresh those values whithout the need to set the requiresDispatch to true again. Guilhem EDIT Here is another attempt following your comment: // Variable that will contain the search we have saved var searchRefreshOnlyOnce = null; Sideview.utils.declareCustomBehavior("refreshOnlyOnce", function(pulldownModule) { // Save the default behavior of the pulldown module requiresDispatch function, so // we can use it the first time (at page load) var requiresDispatchReference = pulldownModule.requiresDispatch.bind(pulldownModule); /** * if the module is configured dynamically then we have to trigger * a new dispatched search. * if the search context is not null, we do not require to dispatch, as we will * use the previously saved search. */ pulldownModule.requiresDispatch = function() { var result; // if this is not the first the requiresDispatch function is called if (this.searchRefreshOnlyOnce != null) { result = false; } // Default behavior when called the first time (we savez the search param for later else { result = requiresDispatchReference(); this.searchRefreshOnlyOnce = this.getContext().get("search"); } return result; } /** * called when a module from downstream requests new context data */ pulldownModule.getModifiedContext = function() { var context = this.getContext(); // If we have saved a search, let's retrieve it from instead of // using the new one (because the new one have no impact on what should be displayed // by this dynamic pulldown) if (this.searchRefreshOnlyOnce !=null) { context.set("search", this.searchRefreshOnlyOnce); } return context; } }); But this doesn't work. I mean yes the search and upstream params are set correctly, but the loading bar and the search are run again. After a little exploration I think it is due to the getContext() method that recursively calls all the parents to update, and those that requiresDispatch will then trigger the search to be run again (it's just a guess after looking at the function). (See AbstractModule.js getContext() function) I am beginning to think it may not be possible to achieve what I want, but at least I have learned something. EDIT 2 corrected some typos and added comments. ... View more

Hello Nick and thanks for your detailed answer. I was thiking there might be an underlying problem with the approach of modifying the pulldown module with a custom behavior, as it is not responsible for the search dispatch, so the modification/ interseption has to be done upstream. I will try to put this together (and read again the advanced XML doc), and hopefully I may post here the results. Thanks, Guilhem ... View more