Dashboards & Visualizations

SearchSelectLister

LauraBre
Communicator

Hello,

I have a problem with my view. I have a dropdown where I recover a set of fields named Users. I want to add a value in the dropdown named "all" which take the value "*" but I don't know how do that because it's a SearchSelectLister and not a StaticSelect.

Thanks by advance to your help,

Laura

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">Requester</param>
    <param name="staticFieldsToDisplay">

      <list>
        <param name="label">all</param>
        <param name="value">*</param>
      </list>
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
          <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">addterm</param>
        <param name="arg">
          <param name="Requester">$target$</param>
        </param>
        <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
        <param name="flags"><list>indexed</list></param>
      </param>
      <module name="SearchSelectLister">
        <param name="settingToCreate">Users_setting</param>
        <param name="label">Select a user</param>
        <param name="search">source="tcp:5543" Users="*" | head 100 |top Users</param>
        <param name="applyOuterIntentionsToInternalSearch">True</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="label">Users</param>
            <param name="value">Users</param>
          </list>
        </param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">Users_setting</param>
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="Users">$target$</param>
            </param>
            <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
            <param name="flags"><list>indexed</list></param>
          </param>
Tags (1)
1 Solution

Ayn
Legend

staticFieldsToDisplay works just as fine for a SearchSelectLister, so just add it exactly as you would with the StaticSelect.

    ...
    <module name="SearchSelectLister">
       <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">All</param>
          </list>
        </param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">name</param>
            <param name="label">name</param>
          </list>
        </param>
        <param name="selected">All</param>
        ...

View solution in original post

Ayn
Legend

staticFieldsToDisplay works just as fine for a SearchSelectLister, so just add it exactly as you would with the StaticSelect.

    ...
    <module name="SearchSelectLister">
       <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">All</param>
          </list>
        </param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">name</param>
            <param name="label">name</param>
          </list>
        </param>
        <param name="selected">All</param>
        ...

helge
Builder

Thanks, worked nicely.

0 Karma

Ayn
Legend

No problem. If my answer solved your problem, could you please mark it as accepted? Thanks!

LauraBre
Communicator

Thx very much to your answer.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...