I'm trying to implement the following advanced view:
This is a mockup, drop-down boxes A,B,C,D will be populated with values from 4 different sourcetypes. The main data is taken from 5-th sourcetype to be filtered out by pulldown selection on each chart.
The tricky thing here is that I want to place Pulldown modules on each panel right next to charts and use them as post-process parameters. Basically (what I have seen in examples) we place Pulldown modules one by one above the main search module and then use the values chosen by user as $foo$ parameters. In my case, I want firstly to execute the main search and then to post-process its results passed downstream to panels, displaying charts based on selection in the Pulldown.
It will be faster (no need to execute main search for the sake of some final filtering) and more user-friendly (a user can choose filters right on each panel, say, if panel count is 10 or more and you have to scroll the web-page). The drop-down boxes are filled in by new searches, each on different sourcetype. I can't combine these searches with the main one, because sourcetypes and output data are different.
The problem is that if I create a new search for each pulldown, postProcess module below no longer sees the results of upstream main search. Looks like new search cleans it up or overrides somehow.
E.g. the postprocess in code sample below
$postProcess$ | where Percentage == “$PercentA$” | table Host, Percentage
doesn't work and produces no data. I want it to inherit the results from main search.
Is there any way to rearrange the modules or use any workaround?
I'm using Sideview Utils 2.2.6.
--
The view structure:
<module name="Search" autoRun=" True">
<param name="search">
sourcetype="Main" … | fields Host, Percentage
</param>
…
<module name="Search" autoRun="True">
<param name="search">sourcetype="ForPulldownA" | stats count by PercentA</param>
<module name="Pulldown">
<param name="name">PercentA</param>
…
<module name="PostProcess">
<param name="search">
$postProcess$ | where Percentage == “$PercentA$” | table Host, Percentage
</param>
<module name="HiddenChartFormatter">
…
</module>
<module name="Search" autoRun="True">
<param name="search">sourcetype="ForPulldownB" | stats count by PercentB</param>
<module name="Pulldown">
<param name="name">PercentB</param>
…
<module name="PostProcess">
<param name="search">
$postProcess$ | where Percentage == “$PercentB$” | table Host, Percentage
</param>
<module name="HiddenChartFormatter">
…
</module>