Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Intentions in drilldown module

$
0
0

I am trying to append the click value to the drill down search, it is appending the value first search clause. but i want it to append to the sub search, is there any way to append the click value to the sub search. Below is the code i am using


<?xml version="1.0" encoding="UTF-8"?>

<view autocancelinterval="90" isvisible="true" onunloadcanceljobs="true" template="dashboard.html" stylesheet="application.css"> <label>API Performance</label> <module name="AccountBar" layoutpanel="appHeader"/> <module name="AppBar" layoutpanel="appHeader"/> <module name="SideviewUtils" layoutpanel="appHeader"/> <module name="Message" layoutpanel="messaging"> <param name="filter"></param> <param name="clearOnJobDispatch">False</param> <param name="maxSize">1</param> </module> <module name="Message" layoutpanel="messaging"> <param name="filter">splunk.search.job</param> <param name="clearOnJobDispatch">True</param> <param name="maxSize">1</param> </module> <module name="URLLoader" layoutpanel="viewHeader" autorun="True"> <module name="TimeRangePicker" layoutpanel="panel_row1_col2" group="Web Logs by Country"> <param name="selected">Last 7 days</param> <param name="searchWhenChanged">True</param> <module name="Search"> <param name="search"> index=test source=/tmp/ | rex "JSESSIONID.*s(?<response_time>[d]+)"| stats avg(response_time) AS response by X_Forwarded_For |
geoip X_Forwarded_For | where X_Forwarded_For_country_name !=""| stats avg(response) AS responsetime by X_Forwarded_For_country_name| where responsetime > 500 | sort -responsetime </param>
<module name="JobProgressIndicator"></module>

<module name="HiddenChartFormatter">
            <param name="chart">pie</param>
            <param name="chart.nullValueMode">zero</param>
            <param name="charting.legend.placement">none</param>
            <param name="secondaryAxisTitle.text">Response Time</param>
             <module name="FlashChart">
                       <!-- <module name="ConvertToDrilldownSearch">
            <module name="SimpleResultsTable">
                    </module> -->
    <!-- swap out the search to be a timechart.  -->
    <module name="HiddenSearch">
      <param name="search">
      index=test source=/tmp/* |
        rex "JSESSIONID.*\s(?&lt;response_time&gt; [\d]+)"| 
        stats avg(response_time) AS response by X_Forwarded_For | 
        geoip X_Forwarded_For |
        where X_Forwarded_For_country_name=$click.value$ |
        stats avg(response) AS responsetime by X_Forwarded_For_city |
        where responsetime > 0 
      </param>
      <param name="earliest">-3d</param>
      <module name="ConvertToIntention">
        <param name="intention">
          <param name="name">addterm</param>
          <param name="arg">
            <param name="X_Forwarded_For_country_name">$click.value$</param>
          </param>
          <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
          <!-- <param name="flags"><list>indexed</list></param> -->
        </param>
        <!-- finally, render the search in another FlashChart, -->
        <!-- and add a JobProgressIndicator for good measure. -->
        <module name="JobProgressIndicator"></module>
        <!-- Use a header to tell the user what they clicked on. -->
        <module name="SimpleResultsHeader">
          <param name="entityName">results</param>
          <param name="headerFormat">
            Response_time for cities in $click.value$
          </param>
        </module> <!-- End SimpleResultsHeader-->

        <module name="HiddenChartFormatter">
          <param name="chart">table</param>
          <param name="primaryAxisTitle.text">Time</param>
          <param name="secondaryAxisTitle.text">events per second</param>
          <param name="legend.placement">none</param>
          <module name="FlashChart">
            <param name="width">100%</param>
            <param name="height">160px</param>
          </module> <!-- End FlashChart-->
        </module> <!-- End HiddenChartFormatter -->
      </module> <!-- End convert to Intention -->
    </module> <!-- End HiddenSearch -->
  </module> <!-- End FlashChart-->
</module> <!-- End HiddenChartFormatter -->

</module> </module> </module> </view>


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>