All Apps and Add-ons

Pulldown default selection using ValueSetter

kenchisho
Path Finder

Hi guys,

I am trying to use the ValueSetter module to populate default values to a multi-select Pulldown module... the purpose is to provide the users with a simple option to hide fields from certain tables with a lot of columns... the code sample is shown bellow

<module name="ValueSetter" >
   <param name="delim">,</param>
   <param name="name">field_filter</param>
   <param name="value ">Field1,Field2,Field3,Field4,Field5</param>
   <module name="Pulldown">
      <param name="size">2</param>
      <param name="separator">+</param>
      <param name="searchFieldsToDisplay">
         <list>
            <param name="value">field_filter</param>
            <param name="label">field_filter</param>
         </list>
      </param>
      <param name="name">field_filter</param>
      <param name="label">Hidden Fields</param>
   </module>
</module>

I have a search with a "| fields - $field_filter$" at the end

When i save the view with the above ValueSetter module it breaks the view and splunk cannot find/display it...

any ideas... or maybe a better way of getting this done?

sideview
SplunkTrust
SplunkTrust

One problem that I see, is that where you specify the "value" param, you actually have a space character after value so it's technically the "value " param. However this would be throwing a much more problematic error and breaking the view, so maybe that's just a typo.

I tried this out very quickly and it seems to work fine. Note that I also chucked an HTML module in there to debug. This can be a very good quick and dirty tool and save you the time of fishing dispatched search language out of HTTP posts with Firebug...

<module name="ValueSetter" >
  <param name="delim">,</param>
  <param name="name">field_filter</param>
  <param name="value">Field1,Field2,Field3,Field4,Field5</param>

  <module name="Pulldown">
    <param name="name">field_filter</param>
    <param name="label">Hidden Fields</param>
    <param name="size">5</param>
    <param name="separator">+</param>
    <param name="searchFieldsToDisplay">
       <list>
          <param name="value">field_filter</param>
          <param name="label">field_filter</param>
       </list>
    </param>

    <module name="Search">
      <param name="search">foo | fields $field_filter$</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          the search is<br>
          $search$<br>
          <br>
          and the field_filter is<br>
          $field_filter$
        ]]></param>
      </module>
    </module>

  </module>
</module>

and for full disclosure, i put all that downstream from the following Search, so I could duplicate the search results that your Pulldown was rendering from...

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">| stats count | eval field_filter=split("Field1,Field2,Field3,Field4,Field5,Field6", ",") | mvexpand field_filter</param>
0 Karma

sideview
SplunkTrust
SplunkTrust

Sideview Utils 2.4.8 just released, in which you will find for the first time good documentation and working examples of all the various uses of the ValueSetter module. http://sideviewapps.com/apps/sideview-utils

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...