All Apps and Add-ons

HiddenSearch -> Paginator -> SearchLinkLister

jensihnow
Path Finder

I would like to speed up a dashbaord with big listings of sourcetypes by using one hidden search over the metadata. The sourcetypes should displayed sorted in different groups represented by several SearchLinkListers. Now i tried puttin everything together but it looks like the SearchLinkLister could not use the inital hiddensearch to do a post processing on it.
applyOuterIntentionsToInternalSearch and postprocess doesn't help out. At the moment i ended with the code above which produces a
SearchLister module SearchLinkLister_0_3_0 was not given a search or a saved search name to power itself and thus cannot render any data. error message.

Is there any way to use a HiddenSearch with a SearchLinkLister?

<view template="dashboard.html" stylesheet="dashboard2.css">
<label>Übersicht 2</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
   <param name="filter">*</param>
   <param name="clearOnJobDispatch">False</param>
   <param name="maxSize">3</param>
</module>
<module name="GenericHeader" layoutPanel="panel_row1_col1">
<param name="label">Process</param>
<module name="HiddenSearch" autoRun="true">
<param name="search">| metadata type=sourcetypes | search totalCount>0 | eval   termkey="sourcetype" | fields sourcetype</param>

<!-- Process -->
        <module name="Paginator" layoutPanel="panel_row1_col1_grp1">
            <param name="count">10</param>
            <param name="entityName">settings</param>
            <param name="maxPages">10</param>
            <module name="SearchLinkLister">
                 <param name="applyOuterIntentionsToInternalSearch">True</param>
                 <param name="postProcess">| where (sourcetype LIKE "process%") AND (not sourcetype LIKE "%int1%") | sort sourcetype</param>
                 <param name="settingToCreate">list1</param>
                 <param name="searchFieldsToDisplay">
                        <list>
                                <param name="label">sourcetype</param>
                                <param name="value">sourcetype</param>
                        </list>
                </param>
                <module name="ConvertToIntention">
                        <param name="settingToConvert">list1</param>
                        <param name="intention">
                                <param name="name">addterm</param>
                                <param name="arg">
                                 <param name="sourcetype">$target$</param>
                                </param>
                        </param>
                        <module name="ViewRedirector">
                                <param name="viewTarget">flashtimeline</param>
                                <param name="uriParam.auto_pause">true</param>
                        </module>
                </module>
            </module>
    </module>
<!-- Process End -->
</module>
</module>
</view>
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

Yes, the way SearchLinkLister was designed, you must supply a search to populate it:

<module name="SearchLinkLister">
   <param name="settingToCreate">list1</param>
   <param name="search">| metadata type=sources</param>
   <param name="searchFieldsToDisplay">
     <list>
       <param name="label">source</param>
       <param name="value">source</param>
     </list>
     <list>
       <param name="label">totalCount</param>
       <param name="labelFormat">number</param>
     </list>
   </param>

View solution in original post

0 Karma

araitz
Splunk Employee
Splunk Employee

Yes, the way SearchLinkLister was designed, you must supply a search to populate it:

<module name="SearchLinkLister">
   <param name="settingToCreate">list1</param>
   <param name="search">| metadata type=sources</param>
   <param name="searchFieldsToDisplay">
     <list>
       <param name="label">source</param>
       <param name="value">source</param>
     </list>
     <list>
       <param name="label">totalCount</param>
       <param name="labelFormat">number</param>
     </list>
   </param>
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...