Dashboards & Visualizations

StaticSelect/stringreplace

LauraBre
Communicator

Hello,

I actually create a view where I want to propose user a pulldown menu and replace in my search the value selected by the user in the menu but I don't do it because I want to use the StaticSelect module but it doesn't work with the intention stringreplace.

Thanks by advance to your help,

<view>  

<module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">host="Laura-PC" |stats $st$</param>

   <module name="ExtendedFieldSearch">

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">count</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Param</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module>

</view>

This is my pulldown module :

<module name="StaticSelect">
<param name="settingToCreate">Requester</param><param name="label">field:</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">fr18126</param>
<param name="value">fr18126</param>
</list>
<list>
<param name="label">a187571</param>
<param name="value">a187571</param>
</list>
</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

Well, I'm not entirely sure of the details, but it seems to me like you're asking how you can take a StaticSelect module and incorporate it into the existing XML where you have a TextField and a HiddenSearch module.

Here's my attempt at doing that, in just the core XML. Note that while ExtendedFieldSearch has its own weird syntax for specifying "intentions", with the "lister" modules as well as with the StaticSelect module, you have to use the ConvertToIntention module, which has its own weird, different syntax.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">field:</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="Requester">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="st">
                  <param name="default">count</param>
                  <param name="value"></param>
              </param>
          </param>
        </param> <!-- End param intention-->

        <param name="replacementMap">
          <param name="arg">
            <param name="st">
                <param name="value"></param>
            </param>
          </param>
        </param> <!-- End param replacementMap -->

        <param name="field">Param</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

For fun I also threw together an example showing the same functionality but built using the modules in Sideview Utils. Here you'll see a static Pulldown module and a simple TextField module, doing exactly the same thing as the above view, but using Sideview Utils.

As you can see, things come out a lot shorter, easier and maybe even a bit more intuitively in Sideview Utils. In any event you wont have to think about 'intentions' anymore ever.

<module name="SideviewUtils" layoutPanel="appHeader" />

<module name="Pulldown" layoutPanel="mainSearchControls">
  <param name="name">Requester</param>
  <param name="label">field:</param>
  <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="TextField">
      <param name="name">st</param>
      <param name="label">Param</param>

      <module name="Search" layoutPanel="mainSearchControls">
        <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

There are other strange things about this view, but for the sake of brevity I wont comment on them since they don't pertain to your actual question.

Lamar
Splunk Employee
Splunk Employee

It's a little unclear why you have your static select separated from your advanced XML above. And since positioning the StaticSelect inside your XML is important this could be causing some issues. Can you post your entire XML file for this dashboard?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...