hello splunkers,
I have the xml code for the lookup updater sideview but I just want to change the header of the page (remove the pulldown for search/application and search/lookup file in order to work directly on my app and my lookup updater)how to change parametre to do that?(replace pulldown)
thanks
In order to not disrupt any other logic on the page, the best thing to do is to replace the two Pulldowns and their searches with a ValueSetter.
More precisely, delete these lines:
<module name="Search">
<param name="search">| splunkentity apps/local | table name</param>
<module name="Pulldown" layoutPanel="mainSearchControls">
<param name="name">app</param>
<param name="label">App:</param>
<param name="valueField">name</param>
<param name="staticOptions"></param>
<module name="Search">
<param name="search">| splunkentity data/lookup-table-files app="$app$" | table name</param>
<module name="Pulldown">
<param name="name">lookupName</param>
<param name="label">Lookup Name:</param>
<param name="valueField">name</param>
<param name="staticOptions"></param>
and replace them with this single ValueSetter module.
<module name="ValueSetter">
<param name="arg.app">YOUR_APP_NAME_HERE</param>
<param name="arg.lookupName">YOUR_LOOKUP_NAME_HERE</param>
Another approach you might have tried (but that I think would have failed) is to go hardcode the tokens in the searches. However some customBehaviors are operating on this page, and those things will need the app and lookupName tokens to be there.
Follow the steps from below post to set the current App context and then you can remove the App dropdown (and update lookup table query to use variable for current app context).
http://answers.splunk.com/answers/25153/determine-the-current-app