I am trying to append the click value to the drill down search, it is appending the value first search clause. but i want it to append to the sub search, is there any way to append the click value to the sub search. Below is the code i am using
<?xml version="1.0" encoding="UTF-8"?>
<view autocancelinterval="90" isvisible="true" onunloadcanceljobs="true" template="dashboard.html" stylesheet="application.css">
<label>API Performance</label>
<module name="AccountBar" layoutpanel="appHeader"/>
<module name="AppBar" layoutpanel="appHeader"/>
<module name="SideviewUtils" layoutpanel="appHeader"/>
<module name="Message" layoutpanel="messaging">
<param name="filter"></param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="Message" layoutpanel="messaging">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="URLLoader" layoutpanel="viewHeader" autorun="True">
<module name="TimeRangePicker" layoutpanel="panel_row1_col2" group="Web Logs by Country">
<param name="selected">Last 7 days</param>
<param name="searchWhenChanged">True</param>
<module name="Search">
<param name="search">
index=test source=/tmp/ | rex "JSESSIONID.*s(?<response_time>[d]+)"|
stats avg(response_time) AS response by X_Forwarded_For |
geoip X_Forwarded_For | where X_Forwarded_For_country_name !=""|
stats avg(response) AS responsetime by X_Forwarded_For_country_name|
where responsetime > 500 |
sort -responsetime
</param>
<module name="JobProgressIndicator"></module>
<module name="HiddenChartFormatter">
<param name="chart">pie</param>
<param name="chart.nullValueMode">zero</param>
<param name="charting.legend.placement">none</param>
<param name="secondaryAxisTitle.text">Response Time</param>
<module name="FlashChart">
<!-- <module name="ConvertToDrilldownSearch">
<module name="SimpleResultsTable">
</module> -->
<!-- swap out the search to be a timechart. -->
<module name="HiddenSearch">
<param name="search">
index=test source=/tmp/* |
rex "JSESSIONID.*\s(?<response_time> [\d]+)"|
stats avg(response_time) AS response by X_Forwarded_For |
geoip X_Forwarded_For |
where X_Forwarded_For_country_name=$click.value$ |
stats avg(response) AS responsetime by X_Forwarded_For_city |
where responsetime > 0
</param>
<param name="earliest">-3d</param>
<module name="ConvertToIntention">
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="X_Forwarded_For_country_name">$click.value$</param>
</param>
<!-- tells the addterm intention to put our term in the first search clause no matter what. -->
<!-- <param name="flags"><list>indexed</list></param> -->
</param>
<!-- finally, render the search in another FlashChart, -->
<!-- and add a JobProgressIndicator for good measure. -->
<module name="JobProgressIndicator"></module>
<!-- Use a header to tell the user what they clicked on. -->
<module name="SimpleResultsHeader">
<param name="entityName">results</param>
<param name="headerFormat">
Response_time for cities in $click.value$
</param>
</module> <!-- End SimpleResultsHeader-->
<module name="HiddenChartFormatter">
<param name="chart">table</param>
<param name="primaryAxisTitle.text">Time</param>
<param name="secondaryAxisTitle.text">events per second</param>
<param name="legend.placement">none</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">160px</param>
</module> <!-- End FlashChart-->
</module> <!-- End HiddenChartFormatter -->
</module> <!-- End convert to Intention -->
</module> <!-- End HiddenSearch -->
</module> <!-- End FlashChart-->
</module> <!-- End HiddenChartFormatter -->
</module> </module> </module> </view>