'unicode' object has no attribute 'get'

[hiddenkirby]

When using the advanced xml... i am doing an inverted-flow layout with text-boxes to filter a simple results table.

Whenever i type something in the text boxes i get "PARSER: Applying intentions failed 'unicode' object has no attribute 'get'. Am i missing a module? Select boxes seem to be working fine... it's only the textboxes.

I tried to mimic the example in simple xml then do showsource=1 .. and i haven't been able to identify any difference.

thoughts?

thanks, Kirby

EDIT: added textbox example

> <module name="ExtendedFieldSearch">
>   <param name="replacementMap">
>     <param name="arg">
>       <param name="hostip"/>
>     </param>
>   </param>
>   <param name="field">Host IP:</param>
>     <param name="intention">
>       <param name="name">stringreplace</param>
>         <param name="arg">
>         <param name="hostip">
>           <param name="default">*</param>
>           <param name="fillOnEmpty">True</param>
>         </param>    
>     </param>
> ...

[sideview]

There's another way that sounds hard at first but in the long run can be vastly easier. And that is to rewrite the view to use Sideview Utils and dispense with "intentions" altogether.

1) Download Sideview Utils from the Sideview site ( http://sideviewapps.com/apps/sideview-utils). It's a Splunk app and it's free for internal use. You'll get a .tar.gz file and you install it by going to Manager > Apps > Install app from file.

2) Watch some of the screencasts to get a sense for what it is - http://www.youtube.com/watch?v=9UTiJ65tlmY

3) read at least the first couple pages of documentation. All docs and examples and tutorials are built into the app itself so you log into Splunk and navigate to the app to learn about it.

4) Put <module name="SideviewUtils" layoutPanel="appHeader"/> into your view, near the AppBar and AccountBar modules. This is required first step to use any other Sideview module in that particular view.

5) Now you're free to start making your views simpler. For instance you can replace this ExtendedFieldSearch + HiddenSearch combo,

<module name="HiddenSearch" layoutPanel="mainSearchControls" autoRun="True">
  <param name="search">
    foo bar baz hostip=$hostip$
  </param>
  <module name="ExtendedFieldSearch">
    <param name="intention">
      <param name="name">stringreplace</param>
      <param name="arg">
        <param name="hostip">
          <param name="default">*</param>
          <param name="fillOnEmpty">True</param>
        </param>    
      </param>
    </param>
    <param name="replacementMap">
      <param name="arg">
        <param name="hostip"/>
      </param>
    </param>
    <param name="field">Host IP:</param>

with TextField + Search

<module name="TextField"  layoutPanel="mainSearchControls" autoRun="True">
  <param name="name">hostip</param>
  <param name="label">Host IP:</param>

  <module name="Search">
    <param name="search">
      foo bar baz hostip=$hostip$
    </param>

Or you can replace this block of HiddenSearch + SearchSelectLister + ConvertToIntention

<module name="HiddenSearch" layoutPanel="mainSearchControls" autoRun="True">
  <param name="earliest">-30d</param>
  <param name="search">
      index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps
  </param>

  <module name="SearchSelectLister">
    <param name="searchWhenChanged">False</param>
    <param name="label">Select series</param>
    <param name="settingToCreate">series_setting</param>
    <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series
        </param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">Any</param>
        <param name="value">*</param>
      </list>
    </param>
    <param name="searchFieldsToDisplay">
      <list>
        <param name="label">series</param>
        <param name="value">series</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">series_setting</param>
      <param name="intention">
        <param name="arg">
          <param name="series">
            <param name="value">$target$</param>
            <param name="fillOnEmpty">True</param>
          </param>
        </param>
        <param name="name">stringreplace</param>
      </param>

with this block of 3 Sideview modules: Search + Pulldown + Search

<module name="Search" layoutPanel="mainSearchControls" autoRun="True">
  <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series</param>
  <param name="earliest">-4h</param>

  <module name="Pulldown">
    <param name="name">series</param>
    <param name="label">Select series</param>
    <param name="valueField">series</param>

    <module name="Search">
      <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</param>
      <param name="earliest">-30d</param>

Here's another screencast, focusing on just the Pulldown module. http://www.youtube.com/watch?v=fkXBgkwZoEQ

[nrelihan]

Has a solution for this been found yet? I have tried the above suggested solution without any luck. I would have imgained Splunk could have solved this by now!
Thanks.

[dottom]

This is still broken in 4.2.1.

[blurblebot]

No luck for me.

I've switched the "intention" and "replacementMap" params in my advanced xml, but as soon as I populate the search field, the error is thrown. If I leave it blank, it uses the default value from the xml, but that's as much luck as I can wrangle. The happens when I try to use the advanced xml given by the "?showsource=t" addition to the "form3" url, too.

TBC - I'm using the ui_examples app views to tinker with. Specifically, I'm trying to mod "form3".

Unfortunately, form3.xml in $SPLUNK_HOME/etc/apps/ui_examples/default/data/ui/views is in simplified xml, so i can't get any clues from that.

thx

[hiddenkirby]

The solution/workaround is simple...

using showsource=true to convert simple to advanced xml yields what you see above in the question.

i'll denote as EFS -> replacementMap -> field -> intention

I replaced with EFS -> intention -> replacementMap -> Field .. and it worked like a charm.

> <module name="ExtendedFieldSearch">
>     <param name="intention">
>       <param name="name">stringreplace</param>
>         <param name="arg">
>         <param name="hostip">
>           <param name="default">*</param>
>           <param name="fillOnEmpty">True</param>
>         </param>    
>     </param>
>     </param>
>   <param name="replacementMap">
>     <param name="arg">
>       <param name="hostip"/>
>     </param>
>   </param>
>   <param name="field">Host IP:</param>
> ...

apologies for the formatting.

[gcoles]

Actually I agree with hiddenkirby. I started with dmlee's suggestion alone but that wasn't enough. My dashboard flow was originally Intention->Replacement->Field. I switched this around to Replacement->Field->Intention (put the intention section at the end), and in combination with dmlee's suggestion, everything worked.

[gkanapathy]

This answer is incorrect. The answer by dmlee is correct.

[dmlee · Accepted solution]

here is my workaround :

for example , the original source code are :

  <param name="replacementMap">
    <param name="arg">
      <param name="sourcetypeToken"/>
    </param>
  </param>

please modify it as below :

  <param name="replacementMap">
    <param name="arg">
      <param name="sourcetypeToken">
        <param name="value"></param>
      </param>
    </param>
  </param>

I tried , it works. Regards,

[therealdpk]

This may have worked on Splunk 4 but does not work on Splunk 5.0.1.

[r999]

just add this line?

    <param name="value"></param>

didnt work for me no change

[MHibbin]

very useful, unsure why converting from simpleXML to advanced using "?showsource=1" doesn't work correctly

[hjwang]

thanks, this answer is correct and is helpful for us. hope splunk's advanced XML syntax can be more rigorous

[hiddenkirby]

I'll take your word for it.. but adding a param of value did not fix my issue. rearranging the modules did. who knows.. likely my mistake.

[gkanapathy]

This answer is correct.

[hiddenkirby]

i added a code segment to what i have above? i couldn't seem to correctly implement your suggestion.

[sideview]

Im afraid there's a known issue at the moment, - the showsource=1 code that converts <form> views from the simplified XML format to the advanced format doesnt work right now and hits this error.

im afraid i dont know of a workaround and Im not sure of an ETA.

What's happening is that the conversion is stripping out a bunch of bits from ConvertToIntention's configuration that have to be there.

In the meantime all I can say is that you can study the advanced xml form search examples in the UI examples app

[hiddenkirby]

ok i'll get on that