Nested intentions

cphair — Tue, 25 Sep 2012 15:58:03 GMT

Hello,

This may be similar to http://splunk-base.splunk.com/answers/2218/adding-intention-to-second-drilldown-search. I have a dashboard with the pattern SearchSelectLister->ConverttoIntention->ConditionalSwitcher->HiddenSearch. I wanted to add a second intention before the switcher, so I stuck an ExtendedFieldSearch just before it. The result was that neither intention was substituted into the HiddenSearch; I was stuck with the $foo$ text. I changed the ExtendedFieldSearch to another SearchSelectLister->ConverttoIntention, to get a dropdown instead of freeform entry, and that worked. Did the ExtendedfieldSearch somehow consume the original intention? In general, how long do intentions stick around--are they only converted when they hit a search module, and does it matter whether they're stringreplace or addterm?

UPDATE: I tried to reproduce this problem on an example dashboard and couldn't. However, on this sample dashboard, the ExtendedFieldSearch only works when it's a child of the search module I'm substituting for. The SearchSelectLister works as the search's parent. Why is this? I find it more intuitive for the intention modules to contain the searches, and I'd prefer to do it that way for all intentions if ExtendedFieldSearch can be used like that.

Re: Nested intentions

melting — Tue, 25 Sep 2012 17:00:23 GMT

Intentions stick around until they are clobbered by another intention of the same name, or until they are used in a search. Both stringreplace and addterm should act the same.

Re: Nested intentions

melting — Tue, 25 Sep 2012 17:01:23 GMT

If you could provide your xml I can try to reproduce and see if we can get it to work with ExtendedFieldSearch.

topic Re: Nested intentions in Dashboards & Visualizations

Nested intentions

Re: Nested intentions

Re: Nested intentions