Dashboards & Visualizations

Text formfield inverted flow in advanced xml example?

hiddenkirby
Contributor

A while back i asked this question http://answers.splunk.com/questions/3606/unicode-object-has-no-attribute-get ... and i couldn't figure out a work around.

I'm curious if anyone as of late has been able to use a form text field to filter a search in a dashboard... using the advanced xml syntax.

thanks, Kirby

Tags (2)
0 Karma
1 Solution

simuvid
Splunk Employee
Splunk Employee

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

View solution in original post

0 Karma

simuvid
Splunk Employee
Splunk Employee

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

View solution in original post

0 Karma

hiddenkirby
Contributor

it looks like the conversion from simple to advanced xml using the showsource=true .. just incorrectly lined up the modules. Your example shows the EFS before the intention and replacementMap ... the conversion (which produced the error) did EFS -> replacementMap -> intention i simply reordered .. and the error went away.

thank you.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.