Dashboards & Visualizations

What am I missing for ConvertToIntention child module?

appleman
Contributor

ダッシュボードで、テーブルの値をクリックすると、その値に沿ったサーチ結果をその下のグラフに表示させたいのですが、下記エラー"This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error."が発生してしまいます。child moduleとして何が足りないのかご教授お願い致します。


Hello,

I'm trying to create a dashboard with "click.value". When you click the result on the table, it will drill down to the column graph. However, an error which is ""This view has a Splunk.Module.ConvertToIntentnion module but it it configured no child module to push its changes to. This represents a configuration error." came out as a result.
I want to know what exactly I should configure as its child module.

Thank you.







1
False


splunk.search.job
1
True


dashboard









Enter number

stringreplace


True




Search
True
True
True

now
aaa
source=
| stats count by enrolled_date

| join [search earliest=-24h@h latest=now index=star $term$]
| stats max(enrolled_date) as enrolled count by product serial
| table enrolled
| eval enrolled=strftime(enrolled,"%c")
-7d@d


count
displayRowNumbers
beforeLabel


True


Enrolled Date







now
bbb
source=*info $term$
| stats max(lastmodified) as lastmodified
| eval lastmodified=strftime(lastmodified,"%c")
-24h@h


count
displayRowNumbers
beforeLabel


True


Lastmodified







now
ccc
source=*db_info $term$
| stats values(user) as user values(product) as product values(serial) as serial values(model) as model values(version) as version values(ip) as ip values(status) as status by id
-24h@h


count


True


20
results

False
True

row
results
20
True


results
id=$click.value$ $time$

  <module name="HiddenSearch" layoutPanel="panel_row3_col1" autoRun="False">
    <param name="search">source=push OR source=access | timechart count by source</param>

    <module name="ConvertToIntention">
       <param name="intention">
           <param name="name">addterm</param>
           <param name="arg">
               <param name="series">$click.value$</param>
           </param>
           <param name="fullName">$click.value$</param>

        <module name="JobProgressIndicator">
            <module name="HiddenChartFormatter">
              <param name="charting.chart">column</param>
              <module name="JSChart">
                <param name="width">100%</param>
                <module name="Gimp"/>
            </module>
          </module>
        </module>
       </param>
      </module>
    </module>
  </module>
</module>







0 Karma

melonman
Motivator

If you are using Splunk6, then you should go with simple XML with JavaScript extention.
There is a example of what you are looking for.

Install Splunk 6 Dashboard Examples app from splunk apps page:
http://apps.splunk.com/app/1603/

You can take a look at the following site:
http://localhost:8000/ja-JP/app/simple_xml_examples/custom_drilldown_form

There is a code sample, so you can actually copy&paste then edit to fit your need.

0 Karma

appleman
Contributor

Is it the same if I'm using SPlunk5?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...