Dashboards & Visualizations

SearchSelectLister

LauraBre
Communicator

Hello,

I have a problem with my view. I have a dropdown where I recover a set of fields named Users. I want to add a value in the dropdown named "all" which take the value "*" but I don't know how do that because it's a SearchSelectLister and not a StaticSelect.

Thanks by advance to your help,

Laura

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">Requester</param>
    <param name="staticFieldsToDisplay">

      <list>
        <param name="label">all</param>
        <param name="value">*</param>
      </list>
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
          <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">addterm</param>
        <param name="arg">
          <param name="Requester">$target$</param>
        </param>
        <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
        <param name="flags"><list>indexed</list></param>
      </param>
      <module name="SearchSelectLister">
        <param name="settingToCreate">Users_setting</param>
        <param name="label">Select a user</param>
        <param name="search">source="tcp:5543" Users="*" | head 100 |top Users</param>
        <param name="applyOuterIntentionsToInternalSearch">True</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="label">Users</param>
            <param name="value">Users</param>
          </list>
        </param>
        <module name="ConvertToIntention">
          <param name="settingToConvert">Users_setting</param>
          <param name="intention">
            <param name="name">addterm</param>
            <param name="arg">
              <param name="Users">$target$</param>
            </param>
            <!-- tells the addterm intention to put our term in the first search clause no matter what. -->
            <param name="flags"><list>indexed</list></param>
          </param>
Tags (1)
1 Solution

Ayn
Legend

staticFieldsToDisplay works just as fine for a SearchSelectLister, so just add it exactly as you would with the StaticSelect.

    ...
    <module name="SearchSelectLister">
       <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">All</param>
          </list>
        </param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">name</param>
            <param name="label">name</param>
          </list>
        </param>
        <param name="selected">All</param>
        ...

View solution in original post

Ayn
Legend

staticFieldsToDisplay works just as fine for a SearchSelectLister, so just add it exactly as you would with the StaticSelect.

    ...
    <module name="SearchSelectLister">
       <param name="staticFieldsToDisplay">
          <list>
            <param name="value">*</param>
            <param name="label">All</param>
          </list>
        </param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">name</param>
            <param name="label">name</param>
          </list>
        </param>
        <param name="selected">All</param>
        ...

helge
Builder

Thanks, worked nicely.

0 Karma

Ayn
Legend

No problem. If my answer solved your problem, could you please mark it as accepted? Thanks!

LauraBre
Communicator

Thx very much to your answer.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...