I’m attempting to make an Advanced XML dashboard that drills down from one chart to another chart. I’ve used a UI Example to get me started.
The first search chart comes up fine. Unfortunately, I can’t get the drilldown search to display any results. I think the nature of my query is causing problems with the ConvertToIntention module. The unusual element in my two searches (top and drilldown) is that it’s a dbquery (i.e. DB Connect).
My first HiddenSearch query contains:
| dbquery JIRA limit=1000 "select [STUFF]" | chart count("pkey") by "Fix Version"
This creates a column chart exactly as I want. When the user clicks on a column, it passes the Fix Version to a drilldown search which is in the XML as:
| dbquery JIRA limit=1000 "select [STUFF]" | chart count("pkey") by "ASSIGNEE"
(“[STUFF]” is the same in each search).
When I try that search alone in a search window it seems to behave fine (except that it’s for all Fix Versions). But, when I inspect the drilldown search, Splunk reports it’s trying to do this:
None | dbquery JIRA limit=1000 "select [STUFF]" | chart count("pkey") by "ASSIGNEE" | search "Fix Version"="13.3.0"
And, what I believe I need is this (which in a search window does just what I want):
| dbquery JIRA limit=1000 "select [STUFF]" | search "Fix Version"="13.3.0" | chart count("pkey") by "ASSIGNEE"
So, the added search term seems to showing up in the wrong place. How can I fix that?
Thanks,
John
... View more