How to swap out the underlying search in a dashboard for a table drilldown using Simple XML?

[lassel]

Hi,

I want to do this, but I'd prefer to do it in Simple XML. Is it possible?
http://docs.splunk.com/Documentation/Splunk/6.3.1/AdvancedDev/TableChartDrilldown#Swap_out_the_under...

I have a table in a dashboard, that shows available log files to the users.

When I drill down, I want to use the values from the row that was clicked, but I don't want the search from the table to go into the drilldown search. That would make the user search in the summary index - and that doesn't make sense, since the index is part of the row clicked!

<dashboard>
  <label>View all logs</label>
  <row>
    <panel>
      <table>
        <search>
          <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">true</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">row</option>
        <option name="count">100</option>
        <option name="table.sortColumn">index</option>
      </table>
    </panel>
  </row>
</dashboard>

Once I get it right, I'll change the dashboard to be powered by a summary index. That just makes it even more important that the drilldown search does not contain the table search.

[lassel · Accepted solution]

Here's a complete working dashboard, with drilldown.

 <dashboard>
   <label>View all logs</label>
   <row>
     <panel>
       <table>
         <search>
           <query>index=* | dedup sourcetype, index, source | table sourcetype, index, source</query>
           <earliest>-15m</earliest>
           <latest>now</latest>
         </search>
         <option name="wrap">true</option>
         <option name="rowNumbers">true</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">row</option>
         <option name="count">100</option>
         <option name="table.sortColumn">index</option>
         <drilldown>
           <link>/app/search/search?q=index=$row.index$ sourcetype=$row.sourcetype$</link>
         </drilldown>
       </table>
     </panel>
   </row>
 </dashboard>

Drilldown only uses index and source for drilldown.
It is easy to add sourcetype too, but if it contains a windows path, it will require some work, escaping backslashes. So I left it out for clarity.

[jeffland]

Are you looking to define a custom search on drilldown? You can simply link to that search then. Run the search you want to run when drilling down and copy the link from the browser address bar. Paste it between the link tags:

<table>
  <search>
    <query>...</query>
    <earliest>...</earliest>
    <latest>...</latest>
  </search>
  ...
  <option name="count">10</option>
  <drilldown>
    <link> paste link here </link>
  </drilldown>
</table>

That should take you to the search right away.