Dashboards & Visualizations

'unicode' object has no attribute 'get'

hiddenkirby
Contributor

When using the advanced xml... i am doing an inverted-flow layout with text-boxes to filter a simple results table.

Whenever i type something in the text boxes i get "PARSER: Applying intentions failed 'unicode' object has no attribute 'get'. Am i missing a module? Select boxes seem to be working fine... it's only the textboxes.

I tried to mimic the example in simple xml then do showsource=1 .. and i haven't been able to identify any difference.

thoughts?

thanks, Kirby

EDIT: added textbox example

> <module name="ExtendedFieldSearch">
>   <param name="replacementMap">
>     <param name="arg">
>       <param name="hostip"/>
>     </param>
>   </param>
>   <param name="field">Host IP:</param>
>     <param name="intention">
>       <param name="name">stringreplace</param>
>         <param name="arg">
>         <param name="hostip">
>           <param name="default">*</param>
>           <param name="fillOnEmpty">True</param>
>         </param>    
>     </param>
> ...
Tags (2)
1 Solution

dmlee
Communicator

here is my workaround :

for example , the original source code are :

  <param name="replacementMap">
    <param name="arg">
      <param name="sourcetypeToken"/>
    </param>
  </param>

please modify it as below :

  <param name="replacementMap">
    <param name="arg">
      <param name="sourcetypeToken">
        <param name="value"></param>
      </param>
    </param>
  </param>

I tried , it works. Regards,

View solution in original post

sideview
SplunkTrust
SplunkTrust

There's another way that sounds hard at first but in the long run can be vastly easier. And that is to rewrite the view to use Sideview Utils and dispense with "intentions" altogether.

1) Download Sideview Utils from the Sideview site ( http://sideviewapps.com/apps/sideview-utils). It's a Splunk app and it's free for internal use. You'll get a .tar.gz file and you install it by going to Manager > Apps > Install app from file.

2) Watch some of the screencasts to get a sense for what it is - http://www.youtube.com/watch?v=9UTiJ65tlmY

3) read at least the first couple pages of documentation. All docs and examples and tutorials are built into the app itself so you log into Splunk and navigate to the app to learn about it.

4) Put <module name="SideviewUtils" layoutPanel="appHeader"/> into your view, near the AppBar and AccountBar modules. This is required first step to use any other Sideview module in that particular view.

5) Now you're free to start making your views simpler. For instance you can replace this ExtendedFieldSearch + HiddenSearch combo,

<module name="HiddenSearch" layoutPanel="mainSearchControls" autoRun="True">
  <param name="search">
    foo bar baz hostip=$hostip$
  </param>
  <module name="ExtendedFieldSearch">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="hostip">
          <param name="default">*</param>
          <param name="fillOnEmpty">True</param>
        </param>    
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="hostip"/>
      </param>
    </param>
    <param name="field">Host IP:</param>

with TextField + Search

<module name="TextField"  layoutPanel="mainSearchControls" autoRun="True">
  <param name="name">hostip</param>
  <param name="label">Host IP:</param>

  <module name="Search">
    <param name="search">
      foo bar baz hostip=$hostip$
    </param>

Or you can replace this block of HiddenSearch + SearchSelectLister + ConvertToIntention

<module name="HiddenSearch" layoutPanel="mainSearchControls" autoRun="True">
  <param name="earliest">-30d</param>
  <param name="search">
      index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps
  </param>

  <module name="SearchSelectLister">
    <param name="searchWhenChanged">False</param>
    <param name="label">Select series</param>
    <param name="settingToCreate">series_setting</param>
    <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series
        </param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">Any</param>
        <param name="value">*</param>
      </list>
    </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">series</param>
        <param name="value">series</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">series_setting</param>
      <param name="intention">
        <param name="arg">
          <param name="series">
            <param name="value">$target$</param>
            <param name="fillOnEmpty">True</param>
          </param>
        </param>
        <param name="name">stringreplace</param>
      </param>

with this block of 3 Sideview modules: Search + Pulldown + Search

<module name="Search" layoutPanel="mainSearchControls" autoRun="True">
  <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series</param>
  <param name="earliest">-4h</param>

  <module name="Pulldown">
    <param name="name">series</param>
    <param name="label">Select series</param>
    <param name="valueField">series</param>

    <module name="Search">
      <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</param>
      <param name="earliest">-30d</param>

Here's another screencast, focusing on just the Pulldown module. http://www.youtube.com/watch?v=fkXBgkwZoEQ

0 Karma

nrelihan
Explorer

Has a solution for this been found yet? I have tried the above suggested solution without any luck. I would have imgained Splunk could have solved this by now!
Thanks.

0 Karma

dottom
Path Finder

This is still broken in 4.2.1.

0 Karma

blurblebot
Communicator

No luck for me.

I've switched the "intention" and "replacementMap" params in my advanced xml, but as soon as I populate the search field, the error is thrown. If I leave it blank, it uses the default value from the xml, but that's as much luck as I can wrangle. The happens when I try to use the advanced xml given by the "?showsource=t" addition to the "form3" url, too.

TBC - I'm using the ui_examples app views to tinker with. Specifically, I'm trying to mod "form3".

Unfortunately, form3.xml in $SPLUNK_HOME/etc/apps/ui_examples/default/data/ui/views is in simplified xml, so i can't get any clues from that.

thx

0 Karma

hiddenkirby
Contributor

The solution/workaround is simple...

using showsource=true to convert simple to advanced xml yields what you see above in the question.

i'll denote as EFS -> replacementMap -> field -> intention

I replaced with EFS -> intention -> replacementMap -> Field .. and it worked like a charm.

> <module name="ExtendedFieldSearch">
>     <param name="intention">
>       <param name="name">stringreplace</param>
>         <param name="arg">
>         <param name="hostip">
>           <param name="default">*</param>
>           <param name="fillOnEmpty">True</param>
>         </param>    
>     </param>
>     </param>
>   <param name="replacementMap">
>     <param name="arg">
>       <param name="hostip"/>
>     </param>
>   </param>
>   <param name="field">Host IP:</param>
> ...

apologies for the formatting.

gcoles
Communicator

Actually I agree with hiddenkirby. I started with dmlee's suggestion alone but that wasn't enough. My dashboard flow was originally Intention->Replacement->Field. I switched this around to Replacement->Field->Intention (put the intention section at the end), and in combination with dmlee's suggestion, everything worked.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This answer is incorrect. The answer by dmlee is correct.

0 Karma

dmlee
Communicator

here is my workaround :

for example , the original source code are :

  <param name="replacementMap">
    <param name="arg">
      <param name="sourcetypeToken"/>
    </param>
  </param>

please modify it as below :

  <param name="replacementMap">
    <param name="arg">
      <param name="sourcetypeToken">
        <param name="value"></param>
      </param>
    </param>
  </param>

I tried , it works. Regards,

therealdpk
Path Finder

This may have worked on Splunk 4 but does not work on Splunk 5.0.1.

0 Karma

r999
Path Finder

just add this line?

    <param name="value"></param>

didnt work for me no change

0 Karma

MHibbin
Influencer

very useful, unsure why converting from simpleXML to advanced using "?showsource=1" doesn't work correctly

0 Karma

hjwang
Contributor

thanks, this answer is correct and is helpful for us. hope splunk's advanced XML syntax can be more rigorous

0 Karma

hiddenkirby
Contributor

I'll take your word for it.. but adding a param of value did not fix my issue. rearranging the modules did. who knows.. likely my mistake.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This answer is correct.

0 Karma

hiddenkirby
Contributor

i added a code segment to what i have above? i couldn't seem to correctly implement your suggestion.

0 Karma

sideview
SplunkTrust
SplunkTrust

Im afraid there's a known issue at the moment, - the showsource=1 code that converts <form> views from the simplified XML format to the advanced format doesnt work right now and hits this error.

im afraid i dont know of a workaround and Im not sure of an ETA.

What's happening is that the conversion is stripping out a bunch of bits from ConvertToIntention's configuration that have to be there.

In the meantime all I can say is that you can study the advanced xml form search examples in the UI examples app

hiddenkirby
Contributor

ok i'll get on that

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...