topic Re: Advanced XML Form Search Problem in Dashboards & Visualizations

Advanced XML Form Search Problem

nrelihan — Mon, 19 Dec 2011 13:11:01 GMT

Has anybody found a fix to convert a form search from simple to advanced XML? I get the following error when I convert it via ?showsource=1
"PARSER: Applying intentions failed 'unicode' object has no attribute 'get'"
I then tried the "fixes" that were supplied on this forum with no luck.
1. Adding ""
2. Swapping the param modules.

I tested these fixes on a simple test form search that is created when you create an new app, incase it was related to my code. So the issues seems to be purely down to incorrect translation from simple to advanced xml.
If any Splunk developer is listening can you please post the correct translation?

Thanks.

Re: Advanced XML Form Search Problem

Drainy — Mon, 19 Dec 2011 13:24:19 GMT

From memory I couldn't tell you but if you could post your new advanced xml I could probably fix it fairly quickly

Re: Advanced XML Form Search Problem

nrelihan — Mon, 19 Dec 2011 13:29:49 GMT

index=sample from="$from$"

<module name="ExtendedFieldSearch">
  <param name="replacementMap">
    <param name="arg">
      <param name="from"/>
    </param>
  </param>
  <param name="field">from</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="from">
        <param name="fillOnEmpty">True</param>
      </param>
    </param>
  </param>

Re: Advanced XML Form Search Problem

Drainy — Mon, 19 Dec 2011 14:37:04 GMT

How about;

  <module name="HiddenSearch" layoutPanel="viewHeader">
    <param name="search">index=sample from="$from$"</param>
    <param name="earliest">-12h@h</param>
    <param name="latest">-5m@m</param>
    <module name="ExtendedFieldSearch">
      <param name="replacementMap">
        <param name="arg">
          <param name="from"/>
        </param>
      </param>
      <param name="field">from</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="from">
            <param name="fillOnEmpty">True</param>
          </param>
        </param>
      </param>
      <module name="SubmitButton">
        <param name="allowSoftSubmit">True</param>
        <param name="label">Search</param>
        <module name="JobStatus">
          <module name="EnablePreview" layoutPanel="panel_row1_col1">
            <param name="enable">True</param>
            <param name="display">False</param>
            <module name="SimpleResultsTable">
              <param name="count">20</param>
              <param name="drilldown">row</param>
              <param name="allowTransformedFieldSelect">True</param>
              <module name="ConvertToDrilldownSearch">
                <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
            <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
            </module>
          </module>
        </module>
      </module>
    </module>

If it works then don't forget to accept this as the right answer 🙂

If it doesn't then leave a comment with any errors etc you may have (Obviously the above is missing the view, label and header fields)

Re: Advanced XML Form Search Problem

nrelihan — Mon, 19 Dec 2011 14:52:51 GMT

Hey Draineh, I'll try that now. I got it working just there also (by copying an existing app).
Thanks.

<module name="ExtendedFieldSearch">
                    <param name="label">from</param>
                    <param name="field">from</param>
    <param name="replacementMap">
      <param name="arg">
        <param name="from">
      <param name="value"></param>
   </param>
     </param>
        </param>
            <param name="intention">
               <param name="name">stringreplace</param>
                 <param name="arg">
                  <param name="from">
                    <param name="default"></param>
                      <param name="fillOnEmpty">false</param>
           </param>
               </param>
                 </param>