Dashboards & Visualizations

Nested intentions

cphair
Builder

Hello,

This may be similar to http://splunk-base.splunk.com/answers/2218/adding-intention-to-second-drilldown-search. I have a dashboard with the pattern SearchSelectLister->ConverttoIntention->ConditionalSwitcher->HiddenSearch. I wanted to add a second intention before the switcher, so I stuck an ExtendedFieldSearch just before it. The result was that neither intention was substituted into the HiddenSearch; I was stuck with the $foo$ text. I changed the ExtendedFieldSearch to another SearchSelectLister->ConverttoIntention, to get a dropdown instead of freeform entry, and that worked. Did the ExtendedfieldSearch somehow consume the original intention? In general, how long do intentions stick around--are they only converted when they hit a search module, and does it matter whether they're stringreplace or addterm?

UPDATE: I tried to reproduce this problem on an example dashboard and couldn't. However, on this sample dashboard, the ExtendedFieldSearch only works when it's a child of the search module I'm substituting for. The SearchSelectLister works as the search's parent. Why is this? I find it more intuitive for the intention modules to contain the searches, and I'd prefer to do it that way for all intentions if ExtendedFieldSearch can be used like that.

Tags (2)
0 Karma

melting
Splunk Employee
Splunk Employee

If you could provide your xml I can try to reproduce and see if we can get it to work with ExtendedFieldSearch.

0 Karma

melting
Splunk Employee
Splunk Employee

Intentions stick around until they are clobbered by another intention of the same name, or until they are used in a search. Both stringreplace and addterm should act the same.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...