Configuration not supported - HiddenSavedSearch does not yet support layering additional intentions on top of a saved search

[royimad]

An exception is throw on the dashboard after calling HiddenSavedSearch module inside a Switcher module saying that HiddenSavedSearch does not yet support layering additional intentions on the top of saved search. ( I actually doesn't now what that mean ? would it be supported in the future?! ).

<?xml version="1.0"?>
<view autoCancelInterval="90" isVisible="true" isSticky="False" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1"
template="dashboard.html">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Reports Performance By Environments</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
<module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>


    <!--
<module name="HTML" layoutPanel="viewHeader">
<param name="html">
<![CDATA[ <h1>Switcher</h1> ]]>
</param>
</module> -->


  <!-- ============================================================================== -->
  <!-- Setup HostName Selection                                                       -->
  <!-- ============================================================================== -->
  <module name="SearchSelectLister" layoutPanel="panel_row1_col1_grp1" autoRun="True">
    <param name="searchWhenChanged">True</param>
    <param name="search">| metadata type=hosts | sort host | where like(host,"%wavemark%")</param>
    <param name="label">Select Environment:</param>
    <param name="settingToCreate">hostname_setting</param>
    <param name="selected">online.wavemark.net</param> 
    <!--
    <param name="staticFieldsToDisplay">
      <list>
        <param name="value"></param>
        <param name="label">None</param>
      </list>
    </param>
    -->
    <param name="searchFieldsToDisplay">
      <list>
        <param name="value">host</param>
        <param name="label">host</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">hostname_setting</param>
      <param name="intention">
        <param name="name">stringreplace</param>
       <param name="arg">
          <param name="hostToken">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>


      <module name="Switcher" group=" "  layoutPanel="panel_row4_col1">
           <param name="selectedGroup">$hostname_setting$</param>

    ...

<module name="HiddenSavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net" autoRun="True">
    <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
    <param name="groupLabel">Daily Long Running Report Trend</param>
    <module name="ViewstateAdapter">
      <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
          <module name="EnablePreview">
            <param name="enable">True</param>
            <param name="display">False</param>
            <module name="HiddenChartFormatter">
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
              <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>

</module>




    </module>  <!-- ** End of ConvertToIntention ** -->
  </module>    <!-- ** End of Host SearchSelectLister ** -->

</view>

[sideview · Accepted solution]

As far as just getting the error to go away, you can delete the ConvertToIntention module, or you can use the Sideview SavedSearch module instead of Splunk's HiddenSavedSearch module.

The real answer though is to not use the Splunk SearchSelectLister or ConvertToIntention modules and use the much easier-to-use Sideview Pulldown module instead.

Here I did those conversions for you

<module name="Search" layoutPanel="panel_row1_col1_grp1" autoRun="True">
  <param name="search">| metadata type=hosts | sort host | where like(host,"%wavemark%")</param>

  <module name="ValueSetter">
    <param name="name">host</param>
    <param name="value">online.wavemark.net</param> 

    <module name="Pulldown">
      <param name="name">host</param>
      <param name="label">Select Environment:</param>
      <param name="valueField">$name$</param>

      <module name="Switcher" group=" "  layoutPanel="panel_row4_col1">
        <param name="selectedGroup">$host$</param>

        ...

        <module name="SavedSearch" layoutPanel="panel_row4_col1" group="stagedb.wavemark.net">
          <param name="name">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
          <module name="ViewstateAdapter">
            <param name="savedSearch">Long Running Reports Trend (2+ Seconds) - Daily Count</param>
            <module name="JobProgressIndicator" />
            <module name="EnablePreview">
              <param name="enable">True</param>
              <param name="display">False</param>
            </module>
            <module name="HiddenChartFormatter">
              <module name="FlashChart">
                <param name="width">100%</param>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>

            </module>
          </module>
        </module>
      </module>

    </module>
  </module>

</view>

I also removed a an autoRun="True" that you had nested inside another autoRun="True". You want to be very careful to never do that because it can cause troublesome behavior where the view appears to be ignoring certain keys. You should always have one at most above every point and in general you want to put it as high as it can go in the XML, generally just a the top.

[sideview]

Oops. my bad. there's no 'savedSearch' param on SavedSearch - it's 'name'. I updated my answer.

[royimad]

I'm receiving the following error
Misconfigured view 'dashboard_side' - Unknown parameter 'savedSearch' is defined for module SavedSearch. Make sure the parameter is specified in SavedSearch.conf. - Should i create a SavedSearch.conf file???