All Apps and Add-ons
Highlighted

Can we use search lister module for static list alone?

New Member

Is there a way to make search lister module mimic a Pull down module in side view utils?
Is so please explain with an example.

0 Karma
Highlighted

Re: Can we use search lister module for static list alone?

SplunkTrust
SplunkTrust

Assuming you mean SearchSelectLister,

  • No, I don't think you can use SearchSelectLister but only to render static options and not dynamic options.
  • If you want to use SearchSelectLister and not use Sideview Utils at all, just download the Dashboard Examples app from Splunk. I believe there are numerous examples that can help you with the complex syntax for SearchSelectLister and that can help you learn about "intentions".
  • If you want to use SearchSelectLister in a view that does use other Sideview modules, but for some reason you just don't want to use the Pulldown module, well that's a really weird thing to do. I have no idea why you would want to, but if you go in Sideview Utils to "Key Techniques > Other > Form Search Comparisons", you'll see the page has links to the same form search page implemented in two different ways. One of the ways using Pulldown modules and the other uses StaticSelect and SearchSelectLister and ConvertToIntention modules.

Here I've copied out an example of each view. Both of these pieces of XML implement a single dynamic pulldown menu.

1) From the view that uses SearchSelectLister and ConvertToIntention.

<module name="SearchSelectLister">
  <param name="settingToCreate">group_setting</param>
  <param name="search">index=_internal source=*metrics.log group="per_*_thruput" | dedup group | fields group | sort - group</param>
  <param name="label">Group</param>
  <param name="applyOuterTimeRangeToInternalSearch">True</param>
  <param name="searchFieldsToDisplay">
    <list>
      <param name="label">group</param>
      <param name="value">group</param>
    </list>
  </param>
  <module name="ConvertToIntention">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="group">
          <param name="value">group="$group_setting$"</param>
        </param>
      </param>
    </param>

2) from the view that uses Pulldown instead:

<module name="Pulldown">
  <param name="name">group</param>
  <param name="label">Group</param>
  <param name="template">$name$="$value$"</param>
  <param name="postProcess">dedup $name$ | fields $name$ | sort - $name$</param>
  <param name="staticOptions"></param>
  <param name="valueField">$name$</param>

Also there's a good screencast about the Pulldown module and how to get the most out of it. http://tinyurl.com/bnq6kzn

0 Karma