Dashboards & Visualizations

ExtendedFieldSearch

tdesaules
New Member

Hello !

I have an issue making an ExtendedFieldSearch in xml

this is my code :

<module name="ExtendedFieldSearch" layoutPanel="panel_row3_col1_grp1">
<param name="replacementMap">
<param name="arg">
<param name="uri_setting"/>
</param>
</param>
<param name="field">Uri:</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="uri_setting">
<param name="default">*</param>
<param name="fillOnEmpty">true</param>
</param>
</param>
</param>

When I try a search, the default value is ok but when I make a change in the text field, nothing happen....

And this is my yime and submi button module :


False
Last 4 hours
<!-- Module boutton recherche -->

True
Search
<!-- Module affichage du graph -->

index=abcroisiere sourcetype="panther_access_abcroisiere" $site$ $tag::uri$ $sHTTP$ uri=$uri_setting$ | table _time uri sHTTP


20
results

True
False

20
row
True


flashtimeline

I have this error on the service_web.log :

==> /data/splunk/var/log/splunk/web_service.log <==
2011-07-07 19:12:30,946 ERROR [4e15e8fef1e317ed0] parser:94 -
'unicode' object has no attribute 'get'
Traceback (most recent call last):
File
"/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/parser.py", line 83, in parse
replacedQ, replacedIntentions =
self._applyStringReplacement(q, decodedIntentions)
File
"/data/splunk/lib/python2.6/site-packages/splunk/appserver/mrsparkle/controllers/parser.py", line 136, in _applyStringReplacement
default = props.get('default', None);
AttributeError: 'unicode' object has no attribute 'get'

If you have any idea thanks 😉

Tags (1)
0 Karma

RicoSuave
Builder

It looks like you have your stringreplace and replacementmap parameters flipped. Stringreplace should come first then replacementmap. I believe this is a bug when using the showsource=true to convert from simple xml formsearch to advanced.

RicoSuave
Builder

I can't figure out how to get the code to post correctly, but just copy and paste it into notepad++ and hopefully it should format correctly

0 Karma

RicoSuave
Builder

Try this code instead.


uri_setting




True











0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...