Dashboards & Visualizations

Search string not visible Drill down

KarunK
Contributor

Hi,

I have created an advanced dashboard and turned on the search drill down. When I do the drill down its working perfectly with one exception, the search string is not visible in the drill down search page.

I am using custom CSS file, But I don't believe it's related.

Any suggestions please ?

Thanks

KK

Tags (1)
0 Karma

KarunK
Contributor

Please find the xml code below.

<view autoCancelInterval="90" isPersistable="true" isSticky="false" isVisible="true" objectMode="viewconf" onunloadCancelJobs="true" stylesheet="custom.css" template="dashboard.html">
  <label>Device</label>
  <module name="SideviewUtils" layoutPanel="messaging"/>
  <module name="AccountBar" layoutPanel="messaging"/>
  <module name="Message" layoutPanel="viewHeader">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">2</param>
  </module>
  <module name="Message" layoutPanel="viewHeader">
    <param name="filter">splunk.search.*</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="LeftNavAppBar" layoutPanel="navigationHeader"/>
  <module name="HiddenSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">|inputlookup cds_address.csv</param>
    <module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True">
      <param name="default">Last 60 minutes</param>
      <param name="searchWhenChanged">True</param>
      <module name="Pulldown">
        <param name="float">left</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">location</param>
            <param name="label">location</param>
          </list>
        </param>
        <param name="name">location</param>
        <param name="postProcess">| inputlookup cds_address | dedup location | table location | sort location</param>
        <param name="label">Location</param>
>
            <module name="SubmitButton">
              <param name="allowSoftSubmit">True</param>
              <module name="Search">
                <param name="search">sourcetype="cds_service_monitor_*" location="$location$"  | timechart span=5m max(cpu_avg) AS "CPU Usage (Avg)", max(web_cpu_percentage) AS "Web Engine CPU Usage", max(wmt_core_cpu_percentage) AS "WMT Core CPU Usage", max(wmt_ml_cpu_percentage) AS "WMT MY CPU Usage", max(uns_cpu_percentage) AS "Unified Namespace CPU Usage", max(sr_cpu_percentage) AS "SR Process CPU Usage"</param>
                <module name="JobProgressIndicator"/>
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter" layoutPanel="panel_row2_col1" group="CPU Utilisation">
                    <param name="groupLabel">CPU Utilisation</param>
                    <param name="secondaryAxisTitle.text">Percentage</param>
                    <param name="charting.chart">area</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <module name="FlashChart">
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
              <module name="Search">
                <param name="search">sourcetype="cds_service_monitor_*" location="$location$"  | timechart span=5m max(mem_avg) AS "Memory Usage (Avg)", max(kernel_mem_avg) AS "Kernel Memory Usage (Avg)"</param>
                <module name="JobProgressIndicator"/>
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter" layoutPanel="panel_row2_col2" group="Memory Utilisation">
                    <param name="groupLabel">Memory Utilisation</param>
                    <param name="secondaryAxisTitle.text">Percentage</param>
                    <param name="charting.chart">area</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <module name="FlashChart">
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
              <module name="Search">
                <param name="search">sourcetype="cds_service_monitor_*" location="$location$" | timechart span=5m max(disk_avg) AS "Disk Utilisation"</param>
                <module name="JobProgressIndicator"/>
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter" layoutPanel="panel_row3_col1" group="Disk Utilisation">
                    <param name="groupLabel">Disk Utilisation</param>
                    <param name="secondaryAxisTitle.text">Percentage</param>
                    <param name="charting.chart">area</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <module name="FlashChart">
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                  </module>
                </module>
              </module>
              <module name="Search">
                <param name="search">sourcetype="cds_service_monitor_*" location="$location$"  | timechart span=5m max(file_desc_count) AS "File Descriptors Open"</param>
                <module name="JobProgressIndicator"/>
                <module name="EnablePreview">
                  <param name="enable">True</param>
                  <param name="display">False</param>
                  <module name="HiddenChartFormatter" layoutPanel="panel_row3_col2" group="File Descriptors">
                    <param name="groupLabel">File Descriptors</param>
                    <param name="secondaryAxisTitle.text">Count</param>
                    <param name="charting.chart">line</param>
                    <param name="primaryAxisTitle.text">Time</param>
                    <module name="FlashChart">
                      <module name="ConvertToDrilldownSearch">
                        <module name="ViewRedirector">
                          <param name="viewTarget">flashtimeline</param>
                        </module>
                      </module>
                    </module>
                  </module>
                  <module name="SoftWrap" layoutPanel="panel_row4_col1">
                    <module name="RowNumbers">
                      <module name="Events"/>
                    </module>
                  </module>
                </module>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>
0 Karma

MarioM
Motivator

When you say you "turned on the search drill down" did you mean you add the following module:

<module name="ConvertToDrilldownSearch">

Can you paste your dashboard advanced xml code?

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...