Dashboards & Visualizations

PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command (can't drill down in redirected flashtimeline)

the_wolverine
Champion

I've seen numerous variations of this ERROR in Answers and wanted to post a specific one. I use a query that combines subsearch, eval and duration to generate a dashboard chart.

When a user clicks on the chart, the resulting flashtimeline looks great. However, clicking on any results from the flashtimeline fail (return nothing.)

I realize there is some trick to getting this to work, perhaps with ConvertToIntention but I'm failing to get it to work. My dashboard started as Simple XML and was converted to Advanced XML using the ?showsource=1 trick. I suspect there is some ugliness in the syntax I have from showsource with respect to properly modifying it to get ConvertToIntention to work properly.

therealdpk
Path Finder

This one caught me too. This solution makes the click work:

http://splunk-base.splunk.com/answers/60224/parser-applying-intentions-failed-unable-to-drilldown-be...

Specifically, add "table" to the end of the HiddenPostProcess search, with a list of fields you want to display. This may not be all you need (my use requires some additional work because one of the fields is obtained from max(_time), and the result of that changes between display and click), but it solves the specific problem.

cphair
Builder

I coded my dashboard from scratch and have the same problem. I opened a support case for it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...