Cannot seem to pass ConvertToIntention's value to the linkSearch in SingleValue module

Hey Jiuan. This can be done, but not this way. First let me try and clear up a couple things--

1) I think the second ConvertToIntention is just a copy and paste error from the example you were using? It will do nothing because it's converting a 'series_setting' key that nobody ever creates. Can you confirm that there's nothing that its supposed to be doing?

2) The 'linkSearch' param on SingleValue never effects the search that the SingleValue renders it's data from. Instead it provides a simple static way to override the search that will run when the user clicks on the link. The search that SingleValue renders from is just determined by the HiddenSearch above it, and any intentions that exist at that point. I have a feeling you may have drawn an understandable but incorrect conclusion as to what the linkSearch param does.

3) let me try and restate your goals from the user's perspective and see if that can shake anything out.

-- user selects an 'app' from the pulldown, or just leaves it at 'App2' which is the default.

-- user selects a timerange, or just leaves it at the default value.

-- Obviously i dont know what the macro's are doing but it seems fair to assume that they are presenting some overall metric of response time. The strange thing that leaps out is that you are running this search without using the user's selection of 'app'. is this intentional? I say this because if you look at the HiddenSearch module right above the SingleValue, there's no $app$ within the 'search' param there.

(Also while we're at it you're doing the stats by app, but the search clause before stats is deliberately narrowing the results to a single app='rsafi' which confuses me a little. At any rate since you're choosing to use the stringreplace intention and there's no $app$ in the search it'll just ignore it. )

-- when the user clicks on the link, now you want to do a different search. Although obviously it's going to be a 'related' search it could be completely different except a) you need it to now use the user's selection of 'app', and b) you need it to use the same timerange.

OK, those are the minor things. At least I think they're minor. =)

Bad news: SingleValue's linkSearch is a very simple, very static parameter and doesnt work this way at all im afraid. It's an optional parameter and if you use it, it overrides the default behaviour and just runs the string you gave it verbatim. There's no dynamic replacement. Hardly anything in 4.0.X actually does dynamic replacement of $foo$ tokens. Without radically digressing we do think about this a lot and it would be cool if in future versions you could re-use dynamic keys anywhere.

Good news: this is possible although i cant think of a way to put the link on the SingleValue module itself.

Again, i assume that you do not intend to use the user's selection for 'app', within the search that generates the average resp_time statistic, so im not doing it here either.

                    <module name="HiddenSearch">
                        <!-- deliberately rendering the SingleValue from a different search that does not consume the $app$ stringreplace intention, but does (implicitly) reuse the timerange -->
                        <param name="search">index=summary summary_type=RSA_REQUEST app=rsafi | stats avg(respTime) as avg by app | `App1_Alert_AvgRt(avg, range)` | `App1_Alert_2_SV(range, sev)` | `App1_Round(avg, 0, " ms")`</param>
                        <module name="SingleValue">
                            <param name="field">avg</param>
                            <param name="classField">sev</param>
                            <param name="linkView">flashtimeline</param>
                            <param name="linkSearch">`App1_Search_All_Logs($app$,"...", ".")`</param>
                        </module>

                        <!-- here though i define another search and it *does* consume the $app$ stringreplace intention. (and again it implicitly will pick up the time range)  -->
                        <module name="HiddenSearch">
                            <!--  since the stringreplace intention with the $app$ key is still there we can refer to it here and it'll be stitched into this search. -->
                            <param name="search">`App1_Search_All_Logs($app$,"...", ".")`</param>

                            <!--  and when the user clicks on the link they'll be redirected to flashtimeline to run the resulting search. See /en-US/modules#Splunk.Module.ViewRedirectorLink for more details on the params of this module -->
                            <module name="ViewRedirectorLink">
                                <param name="viewTarget">flashtimeline</param>
                                <param name="label">Check it out</param>
                            </module>
                        </module>
                    </module>