Dashboards & Visualizations

drilldown click.value & click2.value issue

ypfbkg
Explorer

i have 3 layer drilldown chart

layer 2 drilldown can get the click1.value, and chart works

layer 3 drilldown can get the click2.value(from layer 2), but it can't get the click1.value(from layer 1)

how can i user click1.value in my layer 3 drilldown

below is my xml file, what's my missing ? please help. Thanks.

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">





*
False
1


splunk.search.job
True
1


dashboard


False
Last 30 days

True
Search


<![CDATA[
login by week
]]>

    </param>
  </module>


  <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="true">
    <!--<param name="search">sourcetype="logSample-too_small" | timechart span="1d" count(empName) as Count by empName</param>-->
    <param name="search">index="pmlog_new"| timechart span="1d" dc(empid) as daycount | eval Week = strftime(_time, "%Y")+"-"+strftime(_time, "%V") |chart sum(daycount) as login over Week | sort Week</param>

    <module name="HiddenChartFormatter">
      <param name="charting.chart">column</param>
      <param name="charting.primaryAxisTitle.text">Time</param>
      <param name="charting.secondaryAxisTitle.text">login</param>
      <param name="charting.legend.placement">none</param>

      <module name="JobProgressIndicator"/>

      <!-- here's the FlashChart that we'll click on -->
      <module name="FlashChart">
        <param name="width">100%</param>
        <param name="height">400px</param>
        <param name="enableResize">False</param>
        <param name="drilldownPrefix">click1</param>
        <!-- we swap out the search to be a timechart.  -->
        <module name="HiddenSearch">
          <!--<param name="search">sourcetype="logSample-too_small" | chart count(page) as PageName by page</param>-->
          <param name="search">index="pmlog_new" | eval Week = strftime(_time, "%Y")+"-"+strftime(_time, "%V") | eval user = lower(EmpName) |  search Week="$week$" | chart count(user) as Counter by user | sort Counter</param>
          <!-- this module will grab the value we clicked on and put it in as a searchterm,   series="someSourcetype".   -->
          <module name="ConvertToIntention" layoutPanel="panel_row2_col1">
            <param name="intention">
              <param name="name">stringreplace</param>
              <param name="arg">
                <param name="week">
                  <param name="value">$click1.value$</param>
                </param>
              </param>
              <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
              <param name="flags">
                <list>indexed</list>
              </param>
            </param>

            <!-- finally, we render the search in another FlashChart, and we throw in a JobProgressIndicator for good measure. -->
            <module name="JobProgressIndicator"></module>

            <!-- We throw in a header so we can tell the user what they clicked on. -->
            <module name="SimpleResultsHeader">
              <param name="entityName">results</param>
              <param name="headerFormat">Detail EmpName on $click1.value$</param>
            </module>
            <module name="HiddenChartFormatter">
              <param name="chart">bar</param>
              <param name="primaryAxisTitle.text">EmpName</param>
              <param name="secondaryAxisTitle.text">HittingCount</param>
              <param name="legend.placement">none</param>
              <module name="FlashChart">
                <param name="width">100%</param>
                <param name="height">400px</param>
                <param name="enableResize">False</param>
                <param name="drilldownPrefix">click2</param>
                <!--  we could put more stuff here like another HiddenSearch and a converter and a ViewRedirector...-->

                <module name="HiddenSearch">
                  <!--<param name="search">sourcetype="logSample-too_small" | chart count(page) as PageName by page</param>-->
                  <param name="search">index="pmlog_new" EmpName="$EmpName$"| eval Week = strftime(_time, "%Y")+"-"+strftime(_time, "%V") | search Week="$week$" | eval pageinfo = function+"("+page+")" | chart count(pageinfo) as PageCount by pageinfo</param>
                  <!-- this module will grab the value we clicked on and put it in as a searchterm,   series="someSourcetype".   -->
                  <module name="ConvertToIntention" layoutPanel="panel_row2_col1">
                    <param name="intention">
                      <param name="name">stringreplace</param>
                      <param name="arg">
                        <param name=">week">
                          <param name="value">$click1.value$</param>
                        </param>
                      </param>
                      <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
                      <param name="flags">
                        <list>indexed</list>
                      </param>
                    </param>
                    <param name="intention">
                      <param name="name">stringreplace</param>
                      <param name="arg">
                        <param name="EmpName">
                          <param name="value">$click2.value$</param>
                        </param>
                      </param>
                      <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
                      <param name="flags">
                        <list>indexed</list>
                      </param>
                    </param>
                    <!-- finally, we render the search in another FlashChart, and we throw in a JobProgressIndicator for good measure. -->
                    <module name="JobProgressIndicator"></module>

                    <!-- We throw in a header so we can tell the user what they clicked on. -->
                    <module name="SimpleResultsHeader">
                      <param name="entityName">results</param>
                      <param name="headerFormat">EmpName:$click2.value$ hit page info</param>
                    </module>
                    <module name="HiddenChartFormatter">
                      <param name="chart">bar</param>
                      <param name="primaryAxisTitle.text">PageName</param>
                      <param name="secondaryAxisTitle.text">Hit Rate</param>
                      <param name="legend.placement">none</param>
                      <module name="FlashChart">
                        <param name="width">100%</param>
                        <!--<param name="height">200px</param>-->
                        <param name="enableResize">False</param>
                        <!--  we could put more stuff here like another HiddenSearch and a converter and a ViewRedirector...-->

                      </module>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>

  <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1" group="login by month" autoRun="true">
    <param name="savedSearch">login count by month</param>
    <param name="groupLabel">login by month</param>
    <module name="ViewstateAdapter">
      <param name="savedSearch">login count by month</param>
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
          <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">False</param>
            <module name="HiddenChartFormatter">
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
              <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>


Tags (2)
0 Karma

wwhitener
Communicator

Silly me....and here I nested two ConvertToIntention modules.

0 Karma

sideview
SplunkTrust
SplunkTrust

You can do that too. ypfbkg's solution is the best, exploiting a little known feature in stringreplace. Either way you have to reconvert the intention from the first "layer" (The intentions get sort of "consumed" when they get converted the first time). You may want to look at Sideview utils, because the whole ConvertToIntention module becomes obsolete -- you just go straight to plugging the values into the searches. Not only do you not have to reconvert intentions in Sideview Utils, you dont even need to convert them the first time. 😃

ypfbkg
Explorer

i find the root cause, in arg setting

 <param name="intention">
                  <param name="name">stringreplace</param>
                  <param name="arg">
                    <param name=">week">
                      <param name="value">$click1.value$</param>
                    </param>
                  </param>
                  <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
                  <param name="flags">
                    <list>indexed</list>
                  </param>
                </param>
                <param name="intention">
                  <param name="name">stringreplace</param>
                  <param name="arg">
                    <param name="EmpName">
                      <param name="value">$click2.value$</param>
                    </param>
                  </param>

change arg to below

<param name="arg">
                    <param name=">week">
                      <param name="value">$click1.value$</param>
                    </param>
                    <param name="EmpName">
                      <param name="value">$click2.value$</param>
                    </param>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...