I have a problem with the drilldown in a advanced views.
I have this module and the problem that use a variable as you can view with the name fechaConsulta, in the first query no problem, but splunk don´t change the value in the second query.
Any Idea?
<module name="HiddenSearch" layoutPanel="panel_row2_col2" autoRun="False">
<param name="search">| savedsearch myquery2 fechaConsulta="$fechaConsulta$"<\/param>
<param name="earliest">-1h<\/param>
<module name="HiddenChartFormatter">
<param name="legend.placement">none<\/param>
<module name="JobProgressIndicator"\/>
<module name="SimpleResultsTable">
<param name="drilldown">row<\/param>
<param name="entityName">results<\/param>
<param name="displayRowNumbers">false<\/param>
<module name="SimpleResultsHeader">
<param name="entityName">results<\/param>
<param name="headerFormat">Second Chart<\/param>
<\/module>
<module name="HiddenSearch">
<param name="search">| dbquery Dreivip limit=1000 "select DATE_FORMAT(en.fechaExpedicion,'%d-%m-%Y') as fecha, dato as Myfield from mytable en WHERE DATE(en.fechaExpedicion) BETWEEN DATE(STR_TO_DATE('$fechaConsulta$','%d-%m-%Y') - INTERVAL 3 DAY) AND STR_TO_DATE('$fechaConsulta$','%d-%m-%Y') \nGROUP BY en.fechaExpedicion" | table fecha, * | addtotals fieldname="TOTAL DIA" *<\/param>
<param name="groupLabel">Carga<\/param>
<param name="earliest">-4h@m<\/param>
<param name="latest">now<\/param>
<module name="ViewstateAdapter">
<module name="HiddenFieldPicker">
<param name="strictMode">True<\/param>
<module name="JobProgressIndicator">
<module name="EnablePreview">
<param name="enable">True<\/param>
<param name="display">False<\/param>
<module name="HiddenChartFormatter">
<param name="charting.chart">line<\/param>
<module name="JSChart">
<param name="width">100%<\/param>
<module name="Gimp"\/>
<module name="ConvertToDrilldownSearch">
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline <\/ param>
<\/module>
<\/module>
<\/module>
<module name="ViewRedirectorLink">
<param name="viewTarget">flashtimeline<\/ param>
<\/module>
<\/module>
<\/module>
<\/module>
<\/module>
<\/module>
<\/module>
<\/module>
<\/module>
... View more