Dashboards & Visualizations

Drilldown $click.value$ isn't being replaced

atreece
Path Finder

I am relatively new to drilldowns, so this may just be a simple error in the order of my modules, but the module here isn't replacing $clicked.value$, but instead adding onto the end of the search string.

<module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="Longest Time to Level(Based on Median)" autoRun="False">
  <param name="search">fields "Level Reached", "Median Time to Level"</param>
  <param name="groupLabel">Longest Time to Level(Based on Median)</param>
  <module name="ViewstateAdapter">
    <module name="HiddenFieldPicker">
      <param name="strictMode">True</param>
      <module name="JobProgressIndicator">
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="HiddenChartFormatter">
            <param name="charting.secondaryAxisTitle.text">Minutes</param>
            <param name="charting.chart">bar</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <module name="HiddenSearch">
                <param name="search">index=zos_gameplay event_type="level" 
                | transaction source_player_id maxevents=2 
                | stats max(played_time) as max, min(played_time) as min, min(source_player_level) as StartingLevel, max(source_player_level) AS LevelReached by source_player_id
                | eval level_time=round((max - min)/60000, 2) 
                | where level_time>0| where LevelReached=$click.value$
                | stats list(level_time) as "Time to Level" by source_player_id, source_character_name | sort +"Time to Level"</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="JobProgressIndicator"></module>
                  <module name="SimpleResultsHeader">
                    <param name="entityName">results</param>
                    <param name="headerFormat">Top 10 Fastest Levelers for Level $click.value$</param>
                  </module> 
                  <module name="HiddenChartFormatter">
                    <param name="chart">bar</param>
                    <param name="primaryAxisTitle.text">Character Name</param>
                    <param name="secondaryAxisTitle.text">minutes</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">160px</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

The resulting search string is as follows:

search index=zos_gameplay event_type="level"  
| transaction source_player_id maxevents=2  
| stats  max(played_time) as max, min(played_time) as min, min(source_player_level) as StartingLevel, max(source_player_level) AS LevelReached by source_player_id  
| eval  level_time=round((max - min)/60000, 2)  | where  level_time>0  
| where  LevelReached=$click.value$  
| search "Level Reached"="9" "Median Time to Level"="66.54" 

I don't want the "| search ..." to be added at the end. I just want the level value to replace $clicked.value$

Any suggestions?

Tags (1)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

First, change $click.value$ in your search to $token$.

Then, you will need to add a ConvertToIntention after your HiddenSearch using the "stringreplace" intention:

   <module name="ConvertToIntention">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="token">
            <param name="value">$click.value$</param>
          </param>
        </param>
      </param> 

I think you can lose the ConvertToDrilldownSearch to avoid appending the "...| search...".

View solution in original post

araitz
Splunk Employee
Splunk Employee

First, change $click.value$ in your search to $token$.

Then, you will need to add a ConvertToIntention after your HiddenSearch using the "stringreplace" intention:

   <module name="ConvertToIntention">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="token">
            <param name="value">$click.value$</param>
          </param>
        </param>
      </param> 

I think you can lose the ConvertToDrilldownSearch to avoid appending the "...| search...".

atreece
Path Finder

The search seems to time out...
And actually, this is just a part of the view. I only copied the part that relates to a single panel, partially to keep the amount of code short, and also to keep as much company privacy as possible. the HidenPostProcess is modifying a HiddenSearch defined earlier in the view, and is the source of the chart used for the drilldown.

0 Karma

araitz
Splunk Employee
Splunk Employee

No, it shouldn't. Is there a reason you have a HiddenPostProcess at the top of your view?

0 Karma

atreece
Path Finder

That is exactly what I needed!
But, do Drilldowns time out eventualy? When I use it as a drilldown, I am getting no results, but copying the search it's using and putting it into the search string is giving me a lot of results, after a few minutes.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...