<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to make a multiple search?? in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-multiple-search/m-p/77563#M4186</link>
    <description>&lt;P&gt;I made a dashboard that had a search function. Textfield , dropdown function is included.&lt;BR /&gt;
But it doesn't work.&lt;BR /&gt;
I want to search by 3 parameters.&lt;/P&gt;

&lt;P&gt;After loading , search reference "index=tmsheader $level$ &lt;EM&gt;$AttackerIP$&lt;/EM&gt; &lt;EM&gt;$VictimIP$&lt;/EM&gt; | table A B C D levelsetting ALL * A A B b C C" have to work , but it is displayed "loading..."&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html"&amp;gt;
  &amp;lt;module name="HiddenSearch" layoutPanel="viewHeader"&amp;gt;
    &amp;lt;param name="search"&amp;gt;index=tms_header $level$ *$AttackerIP$* *$VictimIP$* | table A B C D/param&amp;gt;
    &amp;lt;module name="StaticSelect"&amp;gt;
      &amp;lt;param name="settingToCreate"&amp;gt;level_setting&amp;lt;/param&amp;gt;
      &amp;lt;param name="staticFieldsToDisplay"&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;ALL&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;*&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;A&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;A&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;B&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;b&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;C&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;C&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;

          &amp;lt;/param&amp;gt;
          &amp;lt;param name="searchWhenChanged"&amp;gt;True&amp;lt;/param&amp;gt;
          &amp;lt;param name="selected"&amp;gt;*&amp;lt;/param&amp;gt;
          &amp;lt;param name="label"&amp;gt;ABC :&amp;lt;/param&amp;gt;
        &amp;lt;module name="ConvertToIntention"&amp;gt;
            &amp;lt;param name="settingToConvert"&amp;gt;level_setting&amp;lt;/param&amp;gt;
            &amp;lt;param name="intention"&amp;gt;
              &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
              &amp;lt;param name="arg"&amp;gt;
                &amp;lt;param name="level"&amp;gt;
                  &amp;lt;param name="default"&amp;gt;*&amp;lt;/param&amp;gt;
                  &amp;lt;param name="fillOnEmpty"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;param name="value"&amp;gt;$target$&amp;lt;/param&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;
            &amp;lt;/param&amp;gt;
            &amp;lt;module name="ExtendedFieldSearch"&amp;gt;
              &amp;lt;param name="replacementMap"&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="AttackerIP"/&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;
              &amp;lt;param name="field"&amp;gt;AttackerIP:&amp;lt;/param&amp;gt;
              &amp;lt;param name="q"&amp;gt;*&amp;lt;/param&amp;gt;
              &amp;lt;param name="intention"&amp;gt;
                &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="AttackerIP"&amp;gt;
                    &amp;lt;param name="fillOnEmpty"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;/param&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;

            &amp;lt;module name="ExtendedFieldSearch"&amp;gt;
              &amp;lt;param name="replacementMap"&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="VictimIP"/&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;
              &amp;lt;param name="field"&amp;gt;VictimIP:&amp;lt;/param&amp;gt;
              &amp;lt;param name="q"&amp;gt;*&amp;lt;/param&amp;gt;
              &amp;lt;param name="intention"&amp;gt;
                &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="VictimIP"&amp;gt;
                    &amp;lt;param name="fillOnEmpty"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;/param&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;

              &amp;lt;module name="TimeRangePicker"&amp;gt;
                &amp;lt;param name="searchWhenChanged"&amp;gt;True&amp;lt;/param&amp;gt;
                &amp;lt;module name="SubmitButton"&amp;gt;
                  &amp;lt;param name="allowSoftSubmit"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;param name="label"&amp;gt;Search&amp;lt;/param&amp;gt;
                &amp;lt;module name="SubmitButton"&amp;gt;
                  &amp;lt;param name="allowSoftSubmit"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;param name="label"&amp;gt;Report&amp;lt;/param&amp;gt;
                  &amp;lt;module name="Redirector"&amp;gt;
                        &amp;lt;param name="popup"&amp;gt;true&amp;lt;/param&amp;gt;
                        &amp;lt;param name="url"&amp;gt;http://100.100.100.100:8080/jsp/TEST/report.jsp&amp;lt;/param&amp;gt;
                        &amp;lt;param name="arg.event"&amp;gt;$click.fields.EVENT$&amp;lt;/param&amp;gt;
                    &amp;lt;/module&amp;gt;
                  &amp;lt;module name="JobStatus"&amp;gt;

           &amp;lt;module name="FlashTimeline" layoutPanel="graphArea"&amp;gt;
                            &amp;lt;param name="height"&amp;gt;140px&amp;lt;/param&amp;gt;
                            &amp;lt;param name="width"&amp;gt;100%&amp;lt;/param&amp;gt;
                            &amp;lt;module name="TitleBar" layoutPanel="viewHeader"/&amp;gt;
       &amp;lt;/module&amp;gt;       
                  &amp;lt;module name="HiddenPostProcess" layoutPanel="panel_row2_col1" group="EVENT" autoRun="False"&amp;gt;
                    &amp;lt;param name="search"&amp;gt;
                      index=tms_header $level$ *$AttackerIP$* *$VictimIP$* | table A B C D
                    &amp;lt;/param&amp;gt;
                    &amp;lt;param name="groupLabel"&amp;gt;EVENT&amp;lt;/param&amp;gt;
                    &amp;lt;module name="ViewstateAdapter"&amp;gt;
                      &amp;lt;module name="HiddenFieldPicker"&amp;gt;
                        &amp;lt;param name="strictMode"&amp;gt;True&amp;lt;/param&amp;gt;
                        &amp;lt;module name="JobProgressIndicator"&amp;gt;
                          &amp;lt;module name="EnablePreview"&amp;gt;
                            &amp;lt;param name="enable"&amp;gt;True&amp;lt;/param&amp;gt;
                            &amp;lt;param name="display"&amp;gt;False&amp;lt;/param&amp;gt;
                            &amp;lt;module name="HiddenChartFormatter"&amp;gt;
                              &amp;lt;param name="charting.chart"&amp;gt;bar&amp;lt;/param&amp;gt;
                              &amp;lt;module name="FlashChart"&amp;gt;
                              &amp;lt;param name="width"&amp;gt;100%&amp;lt;/param&amp;gt;
                                &amp;lt;module name="ConvertToDrilldownSearch"&amp;gt;
                                  &amp;lt;module name="ViewRedirector"&amp;gt;
                                    &amp;lt;param name="viewTarget"&amp;gt;flashtimeline&amp;lt;/param&amp;gt;
                                  &amp;lt;/module&amp;gt;
                                &amp;lt;/module&amp;gt;
                              &amp;lt;/module&amp;gt;
                              &amp;lt;module name="ViewRedirectorLink"&amp;gt;
                               &amp;lt;param name="viewTarget"&amp;gt;flashtimeline&amp;lt;/param&amp;gt;
                              &amp;lt;/module&amp;gt;
                            &amp;lt;/module&amp;gt;
                          &amp;lt;/module&amp;gt;
                        &amp;lt;/module&amp;gt;
                      &amp;lt;/module&amp;gt;
                    &amp;lt;/module&amp;gt;
                  &amp;lt;/module&amp;gt;
                &amp;lt;/module&amp;gt;
              &amp;lt;/module&amp;gt;
            &amp;lt;/module&amp;gt;
          &amp;lt;/module&amp;gt;
        &amp;lt;/module&amp;gt;
      &amp;lt;/module&amp;gt;
    &amp;lt;/module&amp;gt;
&amp;lt;/module&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;BR /&gt;
&lt;/P&gt;</description>
    <pubDate>Mon, 19 Sep 2011 07:16:15 GMT</pubDate>
    <dc:creator>ilove275</dc:creator>
    <dc:date>2011-09-19T07:16:15Z</dc:date>
    <item>
      <title>How to make a multiple search??</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-multiple-search/m-p/77563#M4186</link>
      <description>&lt;P&gt;I made a dashboard that had a search function. Textfield , dropdown function is included.&lt;BR /&gt;
But it doesn't work.&lt;BR /&gt;
I want to search by 3 parameters.&lt;/P&gt;

&lt;P&gt;After loading , search reference "index=tmsheader $level$ &lt;EM&gt;$AttackerIP$&lt;/EM&gt; &lt;EM&gt;$VictimIP$&lt;/EM&gt; | table A B C D levelsetting ALL * A A B b C C" have to work , but it is displayed "loading..."&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html"&amp;gt;
  &amp;lt;module name="HiddenSearch" layoutPanel="viewHeader"&amp;gt;
    &amp;lt;param name="search"&amp;gt;index=tms_header $level$ *$AttackerIP$* *$VictimIP$* | table A B C D/param&amp;gt;
    &amp;lt;module name="StaticSelect"&amp;gt;
      &amp;lt;param name="settingToCreate"&amp;gt;level_setting&amp;lt;/param&amp;gt;
      &amp;lt;param name="staticFieldsToDisplay"&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;ALL&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;*&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;A&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;A&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;B&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;b&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;
        &amp;lt;list&amp;gt;
            &amp;lt;param name="label"&amp;gt;C&amp;lt;/param&amp;gt;
            &amp;lt;param name="value"&amp;gt;C&amp;lt;/param&amp;gt;
        &amp;lt;/list&amp;gt;

          &amp;lt;/param&amp;gt;
          &amp;lt;param name="searchWhenChanged"&amp;gt;True&amp;lt;/param&amp;gt;
          &amp;lt;param name="selected"&amp;gt;*&amp;lt;/param&amp;gt;
          &amp;lt;param name="label"&amp;gt;ABC :&amp;lt;/param&amp;gt;
        &amp;lt;module name="ConvertToIntention"&amp;gt;
            &amp;lt;param name="settingToConvert"&amp;gt;level_setting&amp;lt;/param&amp;gt;
            &amp;lt;param name="intention"&amp;gt;
              &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
              &amp;lt;param name="arg"&amp;gt;
                &amp;lt;param name="level"&amp;gt;
                  &amp;lt;param name="default"&amp;gt;*&amp;lt;/param&amp;gt;
                  &amp;lt;param name="fillOnEmpty"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;param name="value"&amp;gt;$target$&amp;lt;/param&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;
            &amp;lt;/param&amp;gt;
            &amp;lt;module name="ExtendedFieldSearch"&amp;gt;
              &amp;lt;param name="replacementMap"&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="AttackerIP"/&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;
              &amp;lt;param name="field"&amp;gt;AttackerIP:&amp;lt;/param&amp;gt;
              &amp;lt;param name="q"&amp;gt;*&amp;lt;/param&amp;gt;
              &amp;lt;param name="intention"&amp;gt;
                &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="AttackerIP"&amp;gt;
                    &amp;lt;param name="fillOnEmpty"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;/param&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;

            &amp;lt;module name="ExtendedFieldSearch"&amp;gt;
              &amp;lt;param name="replacementMap"&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="VictimIP"/&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;
              &amp;lt;param name="field"&amp;gt;VictimIP:&amp;lt;/param&amp;gt;
              &amp;lt;param name="q"&amp;gt;*&amp;lt;/param&amp;gt;
              &amp;lt;param name="intention"&amp;gt;
                &amp;lt;param name="name"&amp;gt;stringreplace&amp;lt;/param&amp;gt;
                &amp;lt;param name="arg"&amp;gt;
                  &amp;lt;param name="VictimIP"&amp;gt;
                    &amp;lt;param name="fillOnEmpty"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;/param&amp;gt;
                &amp;lt;/param&amp;gt;
              &amp;lt;/param&amp;gt;

              &amp;lt;module name="TimeRangePicker"&amp;gt;
                &amp;lt;param name="searchWhenChanged"&amp;gt;True&amp;lt;/param&amp;gt;
                &amp;lt;module name="SubmitButton"&amp;gt;
                  &amp;lt;param name="allowSoftSubmit"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;param name="label"&amp;gt;Search&amp;lt;/param&amp;gt;
                &amp;lt;module name="SubmitButton"&amp;gt;
                  &amp;lt;param name="allowSoftSubmit"&amp;gt;True&amp;lt;/param&amp;gt;
                  &amp;lt;param name="label"&amp;gt;Report&amp;lt;/param&amp;gt;
                  &amp;lt;module name="Redirector"&amp;gt;
                        &amp;lt;param name="popup"&amp;gt;true&amp;lt;/param&amp;gt;
                        &amp;lt;param name="url"&amp;gt;http://100.100.100.100:8080/jsp/TEST/report.jsp&amp;lt;/param&amp;gt;
                        &amp;lt;param name="arg.event"&amp;gt;$click.fields.EVENT$&amp;lt;/param&amp;gt;
                    &amp;lt;/module&amp;gt;
                  &amp;lt;module name="JobStatus"&amp;gt;

           &amp;lt;module name="FlashTimeline" layoutPanel="graphArea"&amp;gt;
                            &amp;lt;param name="height"&amp;gt;140px&amp;lt;/param&amp;gt;
                            &amp;lt;param name="width"&amp;gt;100%&amp;lt;/param&amp;gt;
                            &amp;lt;module name="TitleBar" layoutPanel="viewHeader"/&amp;gt;
       &amp;lt;/module&amp;gt;       
                  &amp;lt;module name="HiddenPostProcess" layoutPanel="panel_row2_col1" group="EVENT" autoRun="False"&amp;gt;
                    &amp;lt;param name="search"&amp;gt;
                      index=tms_header $level$ *$AttackerIP$* *$VictimIP$* | table A B C D
                    &amp;lt;/param&amp;gt;
                    &amp;lt;param name="groupLabel"&amp;gt;EVENT&amp;lt;/param&amp;gt;
                    &amp;lt;module name="ViewstateAdapter"&amp;gt;
                      &amp;lt;module name="HiddenFieldPicker"&amp;gt;
                        &amp;lt;param name="strictMode"&amp;gt;True&amp;lt;/param&amp;gt;
                        &amp;lt;module name="JobProgressIndicator"&amp;gt;
                          &amp;lt;module name="EnablePreview"&amp;gt;
                            &amp;lt;param name="enable"&amp;gt;True&amp;lt;/param&amp;gt;
                            &amp;lt;param name="display"&amp;gt;False&amp;lt;/param&amp;gt;
                            &amp;lt;module name="HiddenChartFormatter"&amp;gt;
                              &amp;lt;param name="charting.chart"&amp;gt;bar&amp;lt;/param&amp;gt;
                              &amp;lt;module name="FlashChart"&amp;gt;
                              &amp;lt;param name="width"&amp;gt;100%&amp;lt;/param&amp;gt;
                                &amp;lt;module name="ConvertToDrilldownSearch"&amp;gt;
                                  &amp;lt;module name="ViewRedirector"&amp;gt;
                                    &amp;lt;param name="viewTarget"&amp;gt;flashtimeline&amp;lt;/param&amp;gt;
                                  &amp;lt;/module&amp;gt;
                                &amp;lt;/module&amp;gt;
                              &amp;lt;/module&amp;gt;
                              &amp;lt;module name="ViewRedirectorLink"&amp;gt;
                               &amp;lt;param name="viewTarget"&amp;gt;flashtimeline&amp;lt;/param&amp;gt;
                              &amp;lt;/module&amp;gt;
                            &amp;lt;/module&amp;gt;
                          &amp;lt;/module&amp;gt;
                        &amp;lt;/module&amp;gt;
                      &amp;lt;/module&amp;gt;
                    &amp;lt;/module&amp;gt;
                  &amp;lt;/module&amp;gt;
                &amp;lt;/module&amp;gt;
              &amp;lt;/module&amp;gt;
            &amp;lt;/module&amp;gt;
          &amp;lt;/module&amp;gt;
        &amp;lt;/module&amp;gt;
      &amp;lt;/module&amp;gt;
    &amp;lt;/module&amp;gt;
&amp;lt;/module&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;BR /&gt;
&lt;/P&gt;</description>
      <pubDate>Mon, 19 Sep 2011 07:16:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-multiple-search/m-p/77563#M4186</guid>
      <dc:creator>ilove275</dc:creator>
      <dc:date>2011-09-19T07:16:15Z</dc:date>
    </item>
    <item>
      <title>Re: How to make a multiple search??</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-multiple-search/m-p/77564#M4187</link>
      <description>&lt;P&gt;Save yourself the headaches and switch over to using Sideview utils app modules for form searches. It's a lot easier to code and opens up a whole new world of possibilities. Download the app and walk through all the examples. You won't have to deal with intentions anymore. &lt;/P&gt;</description>
      <pubDate>Tue, 20 Sep 2011 17:08:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-a-multiple-search/m-p/77564#M4187</guid>
      <dc:creator>RicoSuave</dc:creator>
      <dc:date>2011-09-20T17:08:33Z</dc:date>
    </item>
  </channel>
</rss>

