Can we have a drill down search running on click on button ??

[rakesh_498115]

Hi,

I have three buttons say A,B,C when I click on them I need to pass gateway="A" on cliking A and B ,C on clicking them to drilldown search query ..

I tried the following code as follows for that ..but didn't work ? can you pls help me..

My code ..

CSOC Dashboard

layoutPanel="appHeader" />

    <module name="SideviewUtils" layoutPanel="viewHeader" />

    <module name="TitleBar" layoutPanel="viewHeader">
        <param name="actionsMenuFilter">dashboard</param>
    </module>



    <!-- Header - Big text, and definition of the Style for the button headers, and the little JS function that shows/hides the drilldown buttons -->

    <module name="HTML" layoutPanel="panel_row1_col1">
        <param name="html">
            <![CDATA[ <center><font size="6" face="Times New Roman" color="blue">Dialogue Services Performance Dashboard - AverageResponseTimes (Secs)</font></center>
      <br>
      <br>

      <style type="text/css">
        .mainButtonTitle { font-size: 10pt; font-weight:bold; };
      </style>


        <style language="JavaScript">
         function passvalue(id)

{
report_name=id;
}

        </style>          

    ]]>
        </param>
    </module>


    <!-- Hidden Saved Search - Top Level Frame for three Services -->

    <module name="HiddenSavedSearch" layoutPanel="panel_row2_col1_grp1" autoRun="True" group="Top Level">
            <param name="savedSearch">mysavedsearch</param>


        <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1" autoRun="True">
            <param name="search">
                <![CDATA[
            |search gateway="A" |  stats avg(responsetime) as responsetime by report_name, gateway)))
             ]]>
            </param>
            <module name="HTML">
                <param name="html">
                    <![CDATA[ <center>

        <br>
        <span class="mainButtonTitle">

<!---defining first button -- >
A

        </span><br>
        <input type="button"  onclick="passvalue('A')"  value="$results[0].responsetime$" >


        </center>
        ]]>
                </param>
            </module>
        </module>

        <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp2" autoRun="True">
            <param name="search">
                <![CDATA[
         | search gateway="B"   | stats avg(responsetime) as responsetime by report_name, gateway)))
             ]]>
            </param>
            <module name="HTML">
                <param name="html">
                    <![CDATA[ <center>

        <br>
        <span class="mainButtonTitle">

          <!---defining second button -- >


         B

        </span><br>
                   <input type="button"  onclick="passvalue('B')"  value="$results[0].responsetime$" >


        </center>
        ]]>
                </param>
            </module>
        </module>

        <module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp3" autoRun="True">
            <param name="search">
                <![CDATA[
                              |search gateway="C" | stats avg(responsetime) as responsetime by report_name, gateway

         ]]>
            </param>
            <module name="HTML">
                <param name="html">
                    <![CDATA[ <center>

        <br>
        <span class="mainButtonTitle">

<--defining third button -- >
C

        </span><br>
                               <input type="button"  onclick="passvalue('C')"  value="$results[0].responsetime$" >


        </center>
        ]]>
                </param>
            </module>
        </module>

    </module>
    <!-- / End of Top Level Frame - direct search against the summary index for high volume DSs -->

    <!-- / Start of  Second Level Frame -  -->


    <module name="HiddenSavedSearch" layoutPanel="panel_row3_col1_grp1" autoRun="True" group="Top Level">
    <param name="savedSearch">basesearch</param>

    <module name="HiddenPostProcess" layoutPanel="panel_row3_col1_grp1" autoRun="True">
            <param name="search">
                <![CDATA[
    | search report_name="$report_name$"        | stats avg(responsetime) as responsetime by report_name             ]]>
            </param>
            <module name="HTML">
                <param name="html">
                    <![CDATA[ <center>

        <br>
        <span class="mainButtonTitle">

        DRILLDOWNED VALUE - RESPONSE TIME 

        </span><br>
        <input type="button"  value="$results[0].responsetime$" name="XMLG">


        </center>
        ]]>
                </param>
            </module>
        </module>


    <!-- /End of Second Level Frame -  -->




</module>

Here when I click on the buttons A,B,C , I need to the pass the values report_name="A" ... to the below frame i.e frame 2 and display it in a button element.

Please help ..thanx in advance...

[sideview]

There are a lot of problems here. It's hard to find a place to begin.

But it seems most important to say that you've taken something that's quite simple and somehow come at the solution in a way that makes it hellishly complicated. If we back up all the way to your actual requirements, here's my take -- "I need to display the average response times for each of N servers, and if the user wants more detail about a particular server, they can interact with something to get it without leaving the page"

This is a textbook case for a table drilldown, and here's an example of that.

<module name="Search">
  <param name="search">your search terms | stats avg(responsetime) as responsetime by gateway</param>
  <param name="earliest">-24h</param>
  <param name="latest">now</param>

  <module name="Pager">
    <module name="Table">
      <module name="Search">
        <param name="search">some other searchterms gateway="$row.fields.gateway$" | stats avg(someOtherField) as anExampleStatistic</param>
        <module name="HTML">
          <param name="html"><![CDATA[
            gateway $row.fields.gateway$ has a value of $results[0].anExampleStatistic$
          ]]></param>
        </module>
      </module>
    </module>
  </module>
</module>

There are of course other examples in the Sideview Utils docs.

Going from the bottom up, there are a lot of problems and oddities in the XML posted.

-- you are nesting autoRun="True" modules inside other autoRun="True" modules, which is very dangerous and can lead to unpredictable behavior in the UI. But I think you should know this already after having asked so many questions pertaining to autoRun. In some cases nested autoRun="True" attributes might not do harm, but in this case I think they absolutely will be causing problems.

-- your search has a stats command that does a group by two fields - report_name and gateway. At one point in your code it's clear that the "A" and "B" and "C" values are gateway values, but at another point it's pretty clear that they are also "report_name" values. Obviously this is confusing to me in trying to figure out what you're trying to do, and I mention this in case it's actually a simple typo on your part that may be contributing to your confusion as well.

-- Simply plopping a javascript function into the page, calling it when a button is clicked, and having it assign a "report_name" variable in javascript, to a passed value, will have no effect whatsoever on anything. The $foo$ values that you might see in Sideview modules and occasionally in Splunk modules have no relationship to Javascript variables you might declare or set on the page. I can't really say anything more about this besides the fact that if you continue trying to do things the manual way that an experienced web developer might try, well, you will continue not succeeding. Follow the examples and the documentation, which certainly in this case will illuminate ways to do this that are both easier for you the dashboard creator, and that are frankly more usable for your end-users.

-- you're using a <style> tag around your javascript when you intend to use a <script> tag. Needless to say JS not wrapped in a <script> tag will not be run and will have no effect.

-- you're using a savedsearch called here mysavedsearch and then piping those results into postProcess searches. I have a distinct feeling that the savedsearch in question will not have any transforming commands like stats in it, but that rather the savedsearch is just a plain streaming search that returns raw events. If my suspicion is correct then you should carefully read the postProcess documentation, because doing this is an invitation to very bad problems. Since you seem to have Sideview Utils installed, the best docs I happen to know of are in that app, under "Key Techniques > Using PostProcess > Introduction"

-- you're using convertToIntention and then trying to put a stringreplace intention into a HiddenPostProcess module, which will not work. Splunk's HiddenPostProcess module does not support any kind of $foo$ substitution - whether you're substituting an intention or a simple key.

-- along the same vein, if you want to substitute things into postProcess searches you should use the Sideview PostProcess module, and read the docs about that module. However then of course you need neither the stringreplace intention nor the ConvertToIntention module.

-- the combination of this search search gateway="B" | stats avg(responsetime) as responsetime by report_name, gateway) along with the $results[0].responsetime$ key in the HTML module, indicates that you're confused in at least one place. A stats report grouped by report_name, gateway will have one row for every unique combination of the gateway field and the report_name field. Of course since you're filtering all the incoming rows by gateway="B", (unless gateway is a multivalued field) this means that the gateway term in your stats is redundant. Each row in the stats output will just be one of the distinct "report_name" values. Moreover the $results]0].responsetime$ syntax will grab the responseTime from the first row of the search results, which will be the first value of "report_name" if you sort the report_name values alphabetically. This is very arbitrary so I doubt it was your intention. Or possibly there's only one report_name associated with each gateway, in which case the whole presence of the report_name field here is entirely redundant.

[sideview]

Yes. If you want to reuse the same search results you simply replace that Search module with a PostProcess module and that's it. It's both possible and quite easy. check out the documentation and tutorials to see examples.

[jward6004]

@sideview I have a dashboard using panel_row1_col1_grp1 and panel_row1_col1_grp2 to display events on the grp1 panel and a timechart on the grp2 panel.. My question is, how can I drill down into a specific event within the grp1 results panel and not have it redirect me to another page?

[adityapavan18]

Hi Sideview,

In your case wont the search (