Substiute head value with static content value

simuvid — Wed, 06 Apr 2011 22:02:19 GMT

Hi folks,

I have following search param in a HiddenSearch:

      <param name="search">index="overall" src_ip="*" sip_count="*" | chart sum(sip_count) by src_ip | sort - sum(sip_count) | $head$ </param>

And I have an StaticSelect module:

<module name="StaticSelect" layoutPanel="panel_row1_col1">
  <param name="settingToCreate">head</param>
  <param name="label">Top </param>

  <param name="staticFieldsToDisplay">
    <list>
      <param name="label">10</param>
      <param name="value">head 10</param>
    </list>
    <list>
      <param name="label">20</param>
      <param name="value">head 20</param>
    </list>
    <list>
      <param name="label">50</param>
      <param name="value">head 50</param>
    </list>
    <list>
      <param name="label">100</param>
      <param name="value">head 100</param>
    </list>
  </param>

  <module name="ConvertToIntention">
    <param name="settingToConvert">head</param>
    <param name="intention">
      <param name="name">addterm</param>
      <param name="arg">
        <param name="head">$target$</param>
      </param>
    </param>

After running the HiddenSearch I get following error message:

PARSER: Applying intentions failed Error in 'SearchParser': Missing a search command before '$'.

I am lost and confused. Any help is highly appreciated.

Cheers,

Christian

Re: Substiute head value with static content value

hazekamp — Wed, 06 Apr 2011 23:53:02 GMT

Christian,

From your search you are looking to do a token replacement on $head$. To achieve this you need to use a "stringreplace" intention. You can specify "| head $head$" in your search, or use "prefix" in the intention below.

<module name="ConvertToIntention">
  <param name="settingToConvert">head</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="head">
        <param name="fillOnEmpty">False</param>
        <param name="prefix">head </param>
        <param name="value">$target$</param>
      </param>
    </param>
  </param>

topic Re: Substiute head value with static content value in Splunk Search

Substiute head value with static content value

Re: Substiute head value with static content value