Dashboards & Visualizations

StaticSelect/stringreplace

LauraBre
Communicator

Hello,

I actually create a view where I want to propose user a pulldown menu and replace in my search the value selected by the user in the menu but I don't do it because I want to use the StaticSelect module but it doesn't work with the intention stringreplace.

Thanks by advance to your help,

<view>  

<module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">host="Laura-PC" |stats $st$</param>

   <module name="ExtendedFieldSearch">

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">count</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Param</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module>

</view>

This is my pulldown module :

<module name="StaticSelect">
<param name="settingToCreate">Requester</param><param name="label">field:</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">fr18126</param>
<param name="value">fr18126</param>
</list>
<list>
<param name="label">a187571</param>
<param name="value">a187571</param>
</list>
</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

Well, I'm not entirely sure of the details, but it seems to me like you're asking how you can take a StaticSelect module and incorporate it into the existing XML where you have a TextField and a HiddenSearch module.

Here's my attempt at doing that, in just the core XML. Note that while ExtendedFieldSearch has its own weird syntax for specifying "intentions", with the "lister" modules as well as with the StaticSelect module, you have to use the ConvertToIntention module, which has its own weird, different syntax.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">field:</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="Requester">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="st">
                  <param name="default">count</param>
                  <param name="value"></param>
              </param>
          </param>
        </param> <!-- End param intention-->

        <param name="replacementMap">
          <param name="arg">
            <param name="st">
                <param name="value"></param>
            </param>
          </param>
        </param> <!-- End param replacementMap -->

        <param name="field">Param</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

For fun I also threw together an example showing the same functionality but built using the modules in Sideview Utils. Here you'll see a static Pulldown module and a simple TextField module, doing exactly the same thing as the above view, but using Sideview Utils.

As you can see, things come out a lot shorter, easier and maybe even a bit more intuitively in Sideview Utils. In any event you wont have to think about 'intentions' anymore ever.

<module name="SideviewUtils" layoutPanel="appHeader" />

<module name="Pulldown" layoutPanel="mainSearchControls">
  <param name="name">Requester</param>
  <param name="label">field:</param>
  <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="TextField">
      <param name="name">st</param>
      <param name="label">Param</param>

      <module name="Search" layoutPanel="mainSearchControls">
        <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

There are other strange things about this view, but for the sake of brevity I wont comment on them since they don't pertain to your actual question.

Lamar
Splunk Employee
Splunk Employee

It's a little unclear why you have your static select separated from your advanced XML above. And since positioning the StaticSelect inside your XML is important this could be causing some issues. Can you post your entire XML file for this dashboard?

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...