Hi,
I have created an advanced dashboard and turned on the search drill down. When I do the drill down its working perfectly with one exception, the search string is not visible in the drill down search page.
I am using custom CSS file, But I don't believe it's related.
Any suggestions please ?
Thanks
KK
Please find the xml code below.
<view autoCancelInterval="90" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" stylesheet="custom.css" template="dashboard.html">
<label>Device</label>
<module name="SideviewUtils" layoutPanel="messaging"/>
<module name="AccountBar" layoutPanel="messaging"/>
<module name="Message" layoutPanel="viewHeader">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">2</param>
</module>
<module name="Message" layoutPanel="viewHeader">
<param name="filter">splunk.search.*</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="LeftNavAppBar" layoutPanel="navigationHeader"/>
<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">|inputlookup cds_address.csv</param>
<module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True">
<param name="default">Last 60 minutes</param>
<param name="searchWhenChanged">True</param>
<module name="Pulldown">
<param name="float">left</param>
<param name="searchFieldsToDisplay">
<list>
<param name="value">location</param>
<param name="label">location</param>
</list>
</param>
<param name="name">location</param>
<param name="postProcess">| inputlookup cds_address | dedup location | table location | sort location</param>
<param name="label">Location</param>
>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<module name="Search">
<param name="search">sourcetype="cds_service_monitor_*" location="$location$" | timechart span=5m max(cpu_avg) AS "CPU Usage (Avg)", max(web_cpu_percentage) AS "Web Engine CPU Usage", max(wmt_core_cpu_percentage) AS "WMT Core CPU Usage", max(wmt_ml_cpu_percentage) AS "WMT MY CPU Usage", max(uns_cpu_percentage) AS "Unified Namespace CPU Usage", max(sr_cpu_percentage) AS "SR Process CPU Usage"</param>
<module name="JobProgressIndicator"/>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter" layoutPanel="panel_row2_col1" group="CPU Utilisation">
<param name="groupLabel">CPU Utilisation</param>
<param name="secondaryAxisTitle.text">Percentage</param>
<param name="charting.chart">area</param>
<param name="primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="Search">
<param name="search">sourcetype="cds_service_monitor_*" location="$location$" | timechart span=5m max(mem_avg) AS "Memory Usage (Avg)", max(kernel_mem_avg) AS "Kernel Memory Usage (Avg)"</param>
<module name="JobProgressIndicator"/>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter" layoutPanel="panel_row2_col2" group="Memory Utilisation">
<param name="groupLabel">Memory Utilisation</param>
<param name="secondaryAxisTitle.text">Percentage</param>
<param name="charting.chart">area</param>
<param name="primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="Search">
<param name="search">sourcetype="cds_service_monitor_*" location="$location$" | timechart span=5m max(disk_avg) AS "Disk Utilisation"</param>
<module name="JobProgressIndicator"/>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter" layoutPanel="panel_row3_col1" group="Disk Utilisation">
<param name="groupLabel">Disk Utilisation</param>
<param name="secondaryAxisTitle.text">Percentage</param>
<param name="charting.chart">area</param>
<param name="primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="Search">
<param name="search">sourcetype="cds_service_monitor_*" location="$location$" | timechart span=5m max(file_desc_count) AS "File Descriptors Open"</param>
<module name="JobProgressIndicator"/>
<module name="EnablePreview">
<param name="enable">True</param>
<param name="display">False</param>
<module name="HiddenChartFormatter" layoutPanel="panel_row3_col2" group="File Descriptors">
<param name="groupLabel">File Descriptors</param>
<param name="secondaryAxisTitle.text">Count</param>
<param name="charting.chart">line</param>
<param name="primaryAxisTitle.text">Time</param>
<module name="FlashChart">
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
<module name="SoftWrap" layoutPanel="panel_row4_col1">
<module name="RowNumbers">
<module name="Events"/>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>
When you say you "turned on the search drill down" did you mean you add the following module:
<module name="ConvertToDrilldownSearch">
Can you paste your dashboard advanced xml code?