Cant figure out how to make a singleValue drilldown to a line chart

[philclapham]

I'm trying to create a dashboard with a bunch of 'traffic light' style indicators for stats like CPU load, memory use, free disk space, using the *NIX app to collect the data for me. The idea is then to be able to click on any of those indicators and get a graph for how that statistic has varied over the last 12 hours.

I'm just trying to get CPU Load working at the moment, and this is what i have so far. Please excuse typos because i'm manually typing from another system...

<module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">index=os sourcetype=vmstat host=* | multikv fields host loadAvg1mi | rangemap field=loadAvg1mi low=0-1 elevated=1-2 severe=2-99 default=severe | fields range loadAvg1mi</param>
  <param name="earliest">-1m@m</param>
  <param name="latest">now</param>
  <module name="ViewStateAdapter">
    <module name="HiddenFieldPicker">
      <param name="strictMode">True</param>
      <module name="JobProgressIndicator">
        <module name="SingleValue">
          <param name="classField">range</param>
          <module name="HiddenSearch">
            <param name="search">index=os sourcetype=vmstat host=* | multikv fields host loadAvg1mi | timechart span=1m max(loadAvg1mi) by host</param>
            <param name="earliest">-12h</param>
            <module name="JobProgressIndicator"></module>
            <module name="HiddenChartFormatter">
              <param name="chart">line</param>
              <module name="FlashChart">
                <param name="width">100%</param>
                <param name="height">250px</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

If i remove the and everything underneath it, i get my nice colour coded SingleValue. If i reintroduce the HiddenSearch then I get the following message at the top of the page:

This view has a Splunk.Module.SingleValue module configured to push changes to downstream modules. This module never has any changes to push so this represents a configuration error.

and the page itself just displays the line graph that i hoped would only appear when the SingleValue was clicked.

Clearly I'm doing something wrong and trying to make SingleValue do something it shouldn't, but I'm quite stuck as to how to proceed from here.

Any tips would be greatly appreciated!

Cheers,
Phil

[David]

I think you can't drilldown from a SingleValue module in the way you're looking for. Take a look at this question:
http://splunk-base.splunk.com/answers/11152/drilldown-link-in-dashboard

It might be a long road to walk, but you can probably get what you need by crafting your search into a simpleresultstable with the columns CPU, Disk, etc., so you can drilldown that way. It's much less visually attractive, though, obviously.

This might also help you get where you need to go (though it uses Sideview Utils, which is very valuable, but takes some time to learn):
http://splunk-base.splunk.com/answers/25761/how-to-use-redirector-with-singlevalue