I figured out how to create monthly buckets using the join
command, but now I cannot drilldown into my results. Can someone help me figure out how to rewrite my query or enable drilldowns using the join
command?
Encountered an unexpected error while parsing intentions.
PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'join' command.
index="myIndex" host=myHost daysago=30 | stats Count as 30Days by username | join username [search index="myIndex" host=myHost daysago=60 | stats Count as 60Days by username] | join username [search index="myIndex" host=myHost daysago=90 | stats Count as 90Days by username] | join username [search index="myIndex" host=myHost daysago=120 | stats Count as 120Days by username]|fields username, 30Days, 60Days, 90Days, 120Days
In order to work around this limitation, I had to leverage Sideview Utils Redirector
component to build a custom search url
to support the drill down behavior. The other gotcha was creating event types for each join duration type so that the drill down could filter by the proper bucket.
After removing the default ConvertToDrilldownSearch
module, here is the stub of the Redirector
:
The biggest let down of using the splunk markup is that their is no easy way to do conditionals inside a param - or performing an inline evaluation. Maybe this is just my lack of know-how. I've also learned that ConvertToIntention
is completely useless when you need complete control over the search query (e.g. q=search index=myIndex). Stick with SideView Utils Redirector
if you need complete search query control.
In order to work around this limitation, I had to leverage Sideview Utils Redirector
component to build a custom search url
to support the drill down behavior. The other gotcha was creating event types for each join duration type so that the drill down could filter by the proper bucket.
After removing the default ConvertToDrilldownSearch
module, here is the stub of the Redirector
:
The biggest let down of using the splunk markup is that their is no easy way to do conditionals inside a param - or performing an inline evaluation. Maybe this is just my lack of know-how. I've also learned that ConvertToIntention
is completely useless when you need complete control over the search query (e.g. q=search index=myIndex). Stick with SideView Utils Redirector
if you need complete search query control.