Dashboards & Visualizations

Drilldown $click.value$ isn't being replaced

atreece
Path Finder

I am relatively new to drilldowns, so this may just be a simple error in the order of my modules, but the module here isn't replacing $clicked.value$, but instead adding onto the end of the search string.

<module name="HiddenPostProcess" layoutPanel="panel_row1_col1" group="Longest Time to Level(Based on Median)" autoRun="False">
  <param name="search">fields "Level Reached", "Median Time to Level"</param>
  <param name="groupLabel">Longest Time to Level(Based on Median)</param>
  <module name="ViewstateAdapter">
    <module name="HiddenFieldPicker">
      <param name="strictMode">True</param>
      <module name="JobProgressIndicator">
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="HiddenChartFormatter">
            <param name="charting.secondaryAxisTitle.text">Minutes</param>
            <param name="charting.chart">bar</param>
            <module name="FlashChart">
              <param name="width">100%</param>
              <module name="HiddenSearch">
                <param name="search">index=zos_gameplay event_type="level" 
                | transaction source_player_id maxevents=2 
                | stats max(played_time) as max, min(played_time) as min, min(source_player_level) as StartingLevel, max(source_player_level) AS LevelReached by source_player_id
                | eval level_time=round((max - min)/60000, 2) 
                | where level_time>0| where LevelReached=$click.value$
                | stats list(level_time) as "Time to Level" by source_player_id, source_character_name | sort +"Time to Level"</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="JobProgressIndicator"></module>
                  <module name="SimpleResultsHeader">
                    <param name="entityName">results</param>
                    <param name="headerFormat">Top 10 Fastest Levelers for Level $click.value$</param>
                  </module> 
                  <module name="HiddenChartFormatter">
                    <param name="chart">bar</param>
                    <param name="primaryAxisTitle.text">Character Name</param>
                    <param name="secondaryAxisTitle.text">minutes</param>
                    <param name="legend.placement">none</param>
                    <module name="FlashChart">
                      <param name="width">100%</param>
                      <param name="height">160px</param>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

The resulting search string is as follows:

search index=zos_gameplay event_type="level"  
| transaction source_player_id maxevents=2  
| stats  max(played_time) as max, min(played_time) as min, min(source_player_level) as StartingLevel, max(source_player_level) AS LevelReached by source_player_id  
| eval  level_time=round((max - min)/60000, 2)  | where  level_time>0  
| where  LevelReached=$click.value$  
| search "Level Reached"="9" "Median Time to Level"="66.54" 

I don't want the "| search ..." to be added at the end. I just want the level value to replace $clicked.value$

Any suggestions?

Tags (1)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

First, change $click.value$ in your search to $token$.

Then, you will need to add a ConvertToIntention after your HiddenSearch using the "stringreplace" intention:

   <module name="ConvertToIntention">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="token">
            <param name="value">$click.value$</param>
          </param>
        </param>
      </param> 

I think you can lose the ConvertToDrilldownSearch to avoid appending the "...| search...".

View solution in original post

araitz
Splunk Employee
Splunk Employee

First, change $click.value$ in your search to $token$.

Then, you will need to add a ConvertToIntention after your HiddenSearch using the "stringreplace" intention:

   <module name="ConvertToIntention">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="token">
            <param name="value">$click.value$</param>
          </param>
        </param>
      </param> 

I think you can lose the ConvertToDrilldownSearch to avoid appending the "...| search...".

atreece
Path Finder

The search seems to time out...
And actually, this is just a part of the view. I only copied the part that relates to a single panel, partially to keep the amount of code short, and also to keep as much company privacy as possible. the HidenPostProcess is modifying a HiddenSearch defined earlier in the view, and is the source of the chart used for the drilldown.

0 Karma

araitz
Splunk Employee
Splunk Employee

No, it shouldn't. Is there a reason you have a HiddenPostProcess at the top of your view?

0 Karma

atreece
Path Finder

That is exactly what I needed!
But, do Drilldowns time out eventualy? When I use it as a drilldown, I am getting no results, but copying the search it's using and putting it into the search string is giving me a lot of results, after a few minutes.

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...