I've been playing around with advanced xml to create a view with a time picker. I have figured out what I need to do to add charts of data, but how do I add a table of information from a search that uses a chart?
The easiest way to figure this out is to steal it from something already existing. For example, you can look at http://YourInstance:8000/en-US/app/search/search_status?showsource=1
If you scroll down to Common Searches, you'll see the following syntax:
<module name="SimpleResultsTable">
<param name="drilldown">row</param>
<param name="allowTransformedFieldSelect">True</param>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
Which should get you what you're looking for.
Excellent. Check out this Answers as well, for tips on clearing out the showsource=1 unnecessary things. (Like allowTransformedFieldSelect)
http://splunk-base.splunk.com/answers/11844/schedule-pdf-disabled-for-timerangepicker
The ?showsource=1 tip was very useful, and I've now got it working. Thanks.
So, If I'm currently using
It's extremely unlikely that you want that 'allowTransformedFieldSelect' param in there - that's detritus carried over from some long-ago simplified-xml conversion.