Dashboards & Visualizations

how to customize drilldown options in form search?

dianbo_1
Path Finder

Hi,

I want to customize a form search as it described in http://www.splunk.com/base/Documentation/latest/Developer/TableChartDrilldown. It has a input text element "username" in the form, and after clicking the ">" button, it gererates a table. Then, i want to add a "HiddenSearch" module between "SimpleResultsTable" and "ConvertToDrilldownSearch" to customize the drilldown search. In "HiddenSearch", i use $username$ to define its search parameter. But the value i input in the text box can not be transferred to this internal "HiddenSearch". Can anyone give me some suggestions about this?

Thanks,

Dianbo

Tags (1)

sideview
SplunkTrust
SplunkTrust

Since you're re-specifying the hidden search with the stringreplace token in it, you have to re-convert the stringreplace intention to fill it in again.

a lister pattern is basically a 2-module pattern where there's some UI module above with several params on it, one of which is settingToCreate, and then there's always a ConvertToIntention below that has the same value in its settingToConvert param.

What happens is that intentions are consumed whenever a search is kicked off. So the intention created by the ConvertToIntention was consumed when the search was kicked off to populate your table.

If you put a second copy of the ConvertToIntention below the table, then you can do the replacement a second time so it can be replaced in the second search.

( background: although its a bit unintuitive, the reason why we dont let the intentions stick around (and thus why we make the view developer reconvert them) is because in moderately complex drilldown cases you often need the outer intentions to NOT apply to internal searches at all. And adding a mechanism to surgically remove some of the existing intentions seemed trickier than having a convention where you require reconverting them.)

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...