Dashboards & Visualizations

How to addterm to search using two form fields

hiddenkirby
Contributor

So i have a static select of values.. and an ExtendedFieldSearch text form field...

i would like to "addterm" to a hidden search.

my search string would be "index=myindex thestaticselectedvalue=theformfieldentry"

I am using the following but can't seem to get the form field's entry into the value (keeps passing null)

<module name"ConvertToIntention">
  <param name="intention">
   <param name="name">addterm</param>
   <param name="arg">
     <param name="$staticselectedvalue$">$theformfieldentry$</param>
   </param>
  </param>
 <module name="HiddenSearch>
 ... 

I always get "index=myindex staticselectedvalue=null"

halp!

TIA, Kirby

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

ExtendedFieldSearch does not create a "setting" (which is what is "converted" from when you use "ConvertToIntention". Instead, it creates an intention directly. You would need to define the intention in the ExtendedFieldSearch. The problem you'll have is if you're trying to "re-use" the intention, e.g. in clickthrus after it was "consumed" by a search, you won't have a "setting" to re-create the intention from. If this is the case, you'd have to use "TextSetting" instead, though this is different and missing functions that ExtendedFieldSearch provides.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

ExtendedFieldSearch does not create a "setting" (which is what is "converted" from when you use "ConvertToIntention". Instead, it creates an intention directly. You would need to define the intention in the ExtendedFieldSearch. The problem you'll have is if you're trying to "re-use" the intention, e.g. in clickthrus after it was "consumed" by a search, you won't have a "setting" to re-create the intention from. If this is the case, you'd have to use "TextSetting" instead, though this is different and missing functions that ExtendedFieldSearch provides.

hiddenkirby
Contributor

this is helpful. i removed the "addterm" piece of code all together and added $staticselectvalue$=$formfieldvalue$ to my search string ... and it seems to only be passing default.. no matter what i type in. either way this is helpful and thank you.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

A Four-Part Event Series: Full Stack Observability For the AI Era

As AI reshapes applications, infrastructure, and the way teams operate, the traditional boundaries of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...