All Apps and Add-ons

Configuration not supported - HiddenSavedSearch does not yet support layering additional intentions on top of a saved search

royimad
Builder

An exception is throw on the dashboard after calling HiddenSavedSearch module inside a Switcher module saying that HiddenSavedSearch does not yet support layering additional intentions on the top of saved search. ( I actually doesn't now what that mean ? would it be supported in the future?! ).

<?xml version="1.0"?>
<view autoCancelInterval="90" isVisible="true" isSticky="False" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1"
template="dashboard.html">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Reports Performance By Environments</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>


    <!--
<module name="HTML" layoutPanel="viewHeader">
<param name="html">
<![CDATA[ <h1>Switcher</h1> ]]>
</param>
</module> -->


  <!-- ============================================================================== -->
  <!-- Setup HostName Selection                                                       -->
  <!-- ============================================================================== -->
  <module name="SearchSelectLister" layoutPanel="panel_row1_col1_grp1" autoRun="True">
    <param name="searchWhenChanged">True</param>
    <param name="search">| metadata type=hosts | sort host | where like(host,"%wavemark%")</param>
    <param name="label">Select Environment:</param>
    <param name="settingToCreate">hostname_setting</param>
    <param name="selected">online.wavemark.net</param> 
    <!--
    <param name="staticFieldsToDisplay">
      <list>
        <param name="value"></param>
        <param name="label">None</param>
      </list>
    </param>
    -->
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">host</param>
        <param name="label">host</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">hostname_setting</param>
      <param name="intention">
        <param name="name">stringreplace</param>
       <param name="arg">
          <param name="hostToken">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>


      <module name="Switcher" group=" "  layoutPanel="panel_row4_col1">
           <param name="selectedGroup">$hostname_setting$</param>

    ...

<module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net" autoRun="True">
    <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
    <param name="groupLabel">Daily Long Running Report Trend</param>
    <module name="ViewstateAdapter">
      <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
          <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">False</param>
            <module name="HiddenChartFormatter">
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
              <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>

</module>




    </module>  <!-- ** End of ConvertToIntention ** -->
  </module>    <!-- ** End of Host SearchSelectLister ** -->

</view>
1 Solution

sideview
SplunkTrust
SplunkTrust

As far as just getting the error to go away, you can delete the ConvertToIntention module, or you can use the Sideview SavedSearch module instead of Splunk's HiddenSavedSearch module.

The real answer though is to not use the Splunk SearchSelectLister or ConvertToIntention modules and use the much easier-to-use Sideview Pulldown module instead.

Here I did those conversions for you

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search">| metadata type=hosts | sort host | where like(host,"%wavemark%")</param>

  <module name="ValueSetter">
    <param name="name">host</param>
    <param name="value">online.wavemark.net</param> 

    <module name="Pulldown">
      <param name="name">host</param>
      <param name="label">Select Environment:</param>
      <param name="valueField">$name$</param>

      <module name="Switcher" group=" "  layoutPanel="panel_row4_col1">
        <param name="selectedGroup">$host$</param>

        ...

        <module name="SavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net">
          <param name="name">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
          <module name="ViewstateAdapter">
            <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
            <module name="JobProgressIndicator" />
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
            </module>
            <module name="HiddenChartFormatter">
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>

            </module>
          </module>
        </module>
      </module>

    </module>
  </module>

</view>

I also removed a an autoRun="True" that you had nested inside another autoRun="True". You want to be very careful to never do that because it can cause troublesome behavior where the view appears to be ignoring certain keys. You should always have one at most above every point and in general you want to put it as high as it can go in the XML, generally just a the top.

View solution in original post

sideview
SplunkTrust
SplunkTrust

As far as just getting the error to go away, you can delete the ConvertToIntention module, or you can use the Sideview SavedSearch module instead of Splunk's HiddenSavedSearch module.

The real answer though is to not use the Splunk SearchSelectLister or ConvertToIntention modules and use the much easier-to-use Sideview Pulldown module instead.

Here I did those conversions for you

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search">| metadata type=hosts | sort host | where like(host,"%wavemark%")</param>

  <module name="ValueSetter">
    <param name="name">host</param>
    <param name="value">online.wavemark.net</param> 

    <module name="Pulldown">
      <param name="name">host</param>
      <param name="label">Select Environment:</param>
      <param name="valueField">$name$</param>

      <module name="Switcher" group=" "  layoutPanel="panel_row4_col1">
        <param name="selectedGroup">$host$</param>

        ...

        <module name="SavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net">
          <param name="name">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
          <module name="ViewstateAdapter">
            <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
            <module name="JobProgressIndicator" />
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
            </module>
            <module name="HiddenChartFormatter">
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>

            </module>
          </module>
        </module>
      </module>

    </module>
  </module>

</view>

I also removed a an autoRun="True" that you had nested inside another autoRun="True". You want to be very careful to never do that because it can cause troublesome behavior where the view appears to be ignoring certain keys. You should always have one at most above every point and in general you want to put it as high as it can go in the XML, generally just a the top.

sideview
SplunkTrust
SplunkTrust

Oops. my bad. there's no 'savedSearch' param on SavedSearch - it's 'name'. I updated my answer.

0 Karma

royimad
Builder

I'm receiving the following error
Misconfigured view 'dashboard_side' - Unknown parameter 'savedSearch' is defined for module SavedSearch. Make sure the parameter is specified in SavedSearch.conf. - Should i create a SavedSearch.conf file???

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...