Text formfield inverted flow in advanced xml example?

[hiddenkirby]

A while back i asked this question http://answers.splunk.com/questions/3606/unicode-object-has-no-attribute-get ... and i couldn't figure out a work around.

I'm curious if anyone as of late has been able to use a form text field to filter a search in a dashboard... using the advanced xml syntax.

thanks, Kirby

[simuvid · Accepted solution]

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

[hiddenkirby]

it looks like the conversion from simple to advanced xml using the showsource=true .. just incorrectly lined up the modules. Your example shows the EFS before the intention and replacementMap ... the conversion (which produced the error) did EFS -> replacementMap -> intention i simply reordered .. and the error went away.

thank you.