Dashboards & Visualizations

Text formfield inverted flow in advanced xml example?

hiddenkirby
Contributor

A while back i asked this question http://answers.splunk.com/questions/3606/unicode-object-has-no-attribute-get ... and i couldn't figure out a work around.

I'm curious if anyone as of late has been able to use a form text field to filter a search in a dashboard... using the advanced xml syntax.

thanks, Kirby

Tags (2)
0 Karma
1 Solution

simuvid
Splunk Employee
Splunk Employee

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

View solution in original post

0 Karma

simuvid
Splunk Employee
Splunk Employee

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

0 Karma

hiddenkirby
Contributor

it looks like the conversion from simple to advanced xml using the showsource=true .. just incorrectly lined up the modules. Your example shows the EFS before the intention and replacementMap ... the conversion (which produced the error) did EFS -> replacementMap -> intention i simply reordered .. and the error went away.

thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...