drilldown example for dspracklen

<!-- Copyright (C) 2010-2012 Sideview LLC.  All Rights Reserved. -->
<view autoCancelInterval="90" onunloadCancelJobs="true" template="search.html" isSticky="False" isVisible="False">
  <label>dspracklen</label>
  <module name="AccountBar" layoutPanel="appHeader" />
  <module name="AppBar" layoutPanel="appHeader" />
  <module name="SideviewUtils" layoutPanel="appHeader" />

  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="maxSize">2</param>
    <param name="clearOnJobDispatch">False</param>
  </module>

  <module name="HTML" layoutPanel="viewHeader">
    <param name="html"><![CDATA[
    <h1>drilldown example for dspracklen</h1>
    ]]></param>
  </module>

  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <param name="keepURLUpdated">True</param>

    <module name="Search">
      <param name="search">index=_internal sourcetype=splunkd component=metrics group=per_sourcetype_thruput | timechart max(eps) by series</param>
      <param name="earliest">-7d</param>

      <module name="JobProgressIndicator"></module>

      <module name="HiddenChartFormatter">
        <param name="charting.chart">column</param>
        <param name="charting.chart.stackMode">stacked</param>

        <module name="FlashChart">
          <param name="height">150px</param>

          <module name="HTML">
            <param name="html"><![CDATA[
              <b>legacy keys:</b><br>
              click.value = $click.value$<br>
              click.name2 = $click.name2$<br>
              <br>
              Note:  With FlashChart $$click.value$$ will be an isotime string. With JSChart it will be epochtime. Either way it doesn't matter because we don't use that key here.
              <br>
              <b>sideview keys:</b><br>

              search.timeRange.earliest= $search.timeRange.earliest$<br>
              search.timeRange.latest= $search.timeRange.latest$<br>
              search.timeRange.label= $search.timeRange.label$<br>
              <br>

              click.searchTerms = $click.searchTerms$<br>
              <br>
              Note: Generally you would use only click.searchTerms in your search string, and that's it. Nothing else.   For time,  you just let the modules themselves handle the time arguments into the drilldown search.  More precisely, downstream from time drilldowns on all tables and charts, the time bounds of the clicked-upon time bucket will be passed by default to all drilldown searches.  No special syntax or trickery is required.
            ]]></param>
          </module>

          <!-- now we do some odd magic to convert the times into the exact
          string-formatted times that you wanted.

          the following strange looking syntax:
             | stats count | fields - count
          is a way to create a search result with 1 row,  with no fields at all....
          we then use eval to build ourselves a field value with your string time.
          -->

          <module name="Search">
            <param name="search">| stats count | fields - count | eval formattedDrilldownTime=strftime("$search.timeRange.earliest$","%Y-%m-%d %H:%M:%S.%3N %z")</param>

            <module name="ResultsValueSetter">
              <param name="fields">formattedDrilldownTime</param>

              <module name="HTML">
                <param name="html"><![CDATA[
                  <b>custom-string-formatted time key: </b><br>
                  formattedDrilldownTime: $formattedDrilldownTime$<br>
                  <br>
                  To use this in a drilldown search simply nest your Search module inside the ResultsValueSetter and use the key in your search.
                ]]></param>
              </module>
            </module>


          </module>
        </module>
      </module>
    </module>
  </module>
</view>