Dashboards & Visualizations

StaticSelect/stringreplace

LauraBre
Communicator

Hello,

I actually create a view where I want to propose user a pulldown menu and replace in my search the value selected by the user in the menu but I don't do it because I want to use the StaticSelect module but it doesn't work with the intention stringreplace.

Thanks by advance to your help,

<view>  

<module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">host="Laura-PC" |stats $st$</param>

   <module name="ExtendedFieldSearch">

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">count</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Param</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module>

</view>

This is my pulldown module :

<module name="StaticSelect">
<param name="settingToCreate">Requester</param><param name="label">field:</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">fr18126</param>
<param name="value">fr18126</param>
</list>
<list>
<param name="label">a187571</param>
<param name="value">a187571</param>
</list>
</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

Well, I'm not entirely sure of the details, but it seems to me like you're asking how you can take a StaticSelect module and incorporate it into the existing XML where you have a TextField and a HiddenSearch module.

Here's my attempt at doing that, in just the core XML. Note that while ExtendedFieldSearch has its own weird syntax for specifying "intentions", with the "lister" modules as well as with the StaticSelect module, you have to use the ConvertToIntention module, which has its own weird, different syntax.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">field:</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="Requester">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="st">
                  <param name="default">count</param>
                  <param name="value"></param>
              </param>
          </param>
        </param> <!-- End param intention-->

        <param name="replacementMap">
          <param name="arg">
            <param name="st">
                <param name="value"></param>
            </param>
          </param>
        </param> <!-- End param replacementMap -->

        <param name="field">Param</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

For fun I also threw together an example showing the same functionality but built using the modules in Sideview Utils. Here you'll see a static Pulldown module and a simple TextField module, doing exactly the same thing as the above view, but using Sideview Utils.

As you can see, things come out a lot shorter, easier and maybe even a bit more intuitively in Sideview Utils. In any event you wont have to think about 'intentions' anymore ever.

<module name="SideviewUtils" layoutPanel="appHeader" />

<module name="Pulldown" layoutPanel="mainSearchControls">
  <param name="name">Requester</param>
  <param name="label">field:</param>
  <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="TextField">
      <param name="name">st</param>
      <param name="label">Param</param>

      <module name="Search" layoutPanel="mainSearchControls">
        <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

There are other strange things about this view, but for the sake of brevity I wont comment on them since they don't pertain to your actual question.

Lamar
Splunk Employee
Splunk Employee

It's a little unclear why you have your static select separated from your advanced XML above. And since positioning the StaticSelect inside your XML is important this could be causing some issues. Can you post your entire XML file for this dashboard?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...