All Apps and Add-ons

Can we use search lister module for static list alone?

premkumarprem96
New Member

Is there a way to make search lister module mimic a Pull down module in side view utils?
Is so please explain with an example.

0 Karma

sideview
SplunkTrust
SplunkTrust

Assuming you mean SearchSelectLister,

  • No, I don't think you can use SearchSelectLister but only to render static options and not dynamic options.
  • If you want to use SearchSelectLister and not use Sideview Utils at all, just download the Dashboard Examples app from Splunk. I believe there are numerous examples that can help you with the complex syntax for SearchSelectLister and that can help you learn about "intentions".
  • If you want to use SearchSelectLister in a view that does use other Sideview modules, but for some reason you just don't want to use the Pulldown module, well that's a really weird thing to do. I have no idea why you would want to, but if you go in Sideview Utils to "Key Techniques > Other > Form Search Comparisons", you'll see the page has links to the same form search page implemented in two different ways. One of the ways using Pulldown modules and the other uses StaticSelect and SearchSelectLister and ConvertToIntention modules.

Here I've copied out an example of each view. Both of these pieces of XML implement a single dynamic pulldown menu.

1) From the view that uses SearchSelectLister and ConvertToIntention.

<module name="SearchSelectLister">
  <param name="settingToCreate">group_setting</param>
  <param name="search">index=_internal source=*metrics.log group="per_*_thruput" | dedup group | fields group | sort - group</param>
  <param name="label">Group</param>
  <param name="applyOuterTimeRangeToInternalSearch">True</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">group</param>
      <param name="value">group</param>
    </list>
  </param>
  <module name="ConvertToIntention">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="group">
          <param name="value">group="$group_setting$"</param>
        </param>
      </param>
    </param>

2) from the view that uses Pulldown instead:

<module name="Pulldown">
  <param name="name">group</param>
  <param name="label">Group</param>
  <param name="template">$name$="$value$"</param>
  <param name="postProcess">dedup $name$ | fields $name$ | sort - $name$</param>
  <param name="staticOptions"></param>
  <param name="valueField">$name$</param>

Also there's a good screencast about the Pulldown module and how to get the most out of it. http://tinyurl.com/bnq6kzn

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...