ExtendedFieldSearch

tdesaules — Mon, 28 Sep 2020 09:43:20 GMT

Hello !

I have an issue making an ExtendedFieldSearch in xml

this is my code :

<module name="ExtendedFieldSearch" layoutPanel="panel_row3_col1_grp1"> <param name="replacementMap"> <param name="arg"> <param name="uri_setting"/> </param> </param> <param name="field">Uri:</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="uri_setting"> <param name="default">*</param> <param name="fillOnEmpty">true</param> </param> </param> </param>

When I try a search, the default value is ok but when I make a change in the text field, nothing happen....

And this is my yime and submi button module :

False
Last 4 hours


True
Search


index=abcroisiere sourcetype="panther_access_abcroisiere" $site$ $tag::uri$ $sHTTP$ uri=$uri_setting$ | table _time uri sHTTP

20
results

True
False

20
row
True

flashtimeline

I have this error on the service_web.log :

==> /data/splunk/var/log/splunk/web_service.log <==
2011-07-07 19:12:30,946 ERROR [4e15e8fef1e317ed0] parser:94 -
'unicode' object has no attribute 'get'
Traceback (most recent call last):
File
"/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/parser.py", line 83, in parse
replacedQ, replacedIntentions =
self._applyStringReplacement(q, decodedIntentions)
File
"/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/parser.py", line 136, in _applyStringReplacement
default = props.get('default', None);
AttributeError: 'unicode' object has no attribute 'get'

If you have any idea thanks 😉

Re: ExtendedFieldSearch

RicoSuave — Fri, 08 Jul 2011 12:30:36 GMT

It looks like you have your stringreplace and replacementmap parameters flipped. Stringreplace should come first then replacementmap. I believe this is a bug when using the showsource=true to convert from simple xml formsearch to advanced.

Re: ExtendedFieldSearch

RicoSuave — Mon, 28 Sep 2020 09:43:33 GMT

Try this code instead.

uri_setting

True

Re: ExtendedFieldSearch

RicoSuave — Fri, 08 Jul 2011 12:45:07 GMT

I can't figure out how to get the code to post correctly, but just copy and paste it into notepad++ and hopefully it should format correctly

topic Re: ExtendedFieldSearch in Dashboards & Visualizations

ExtendedFieldSearch

Re: ExtendedFieldSearch

Re: ExtendedFieldSearch

Re: ExtendedFieldSearch