Splunk Search

Second dropdown is not getting populated ??

ranjyotiprakash
Communicator

I am using two dropdowns in a view in my applicationa. First drop down is getting populated and I want the second dropdown to get populated based on the item selected in first drop down. But, the second dropdown is not getting populated.

I am posting the code here :
enter code here




*
False
1


dashboard


Select the Box Unit Name from the Drop-Down Menu


True
uname_setting
Unit Name :
test search


unit_name
unit_name



uname_setting

stringreplace


$target$


            <module name="SearchSelectLister" layoutPanel="panel_row1_col1" autoRun="True">
                    <param name="searchWhenChanged">True</param>
                    <param name="settingToCreate">service_setting</param>
                    <param name="label">Service :</param>
                    <param name="search">sourcetype="firewall" | eval ip_port = app_ip +":"+ app_port | chart count over ip_port</param>
                    <param name="searchFieldsToDisplay">
                            <list>
                                    <param name="label">service_ipport</param>
                                    <param name="value">service_ipport</param>

                            </list>
                    </param>
                    <module name="ConvertToIntention">
                            <param name="settingToConvert">service_setting</param>
                            <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                            <param name="service_ipport">
                                                    <param name="value">$target$</param>
                                            </param>
                                    </param>
                            </param>


    <module name="StaticContentSample" layoutPanel="panel_row1_col1">
            <param name="text">You can adjust the time range of the audit reports
                    by selecting your desired time using the picker below.</param>
    </module>


Last 60 minutes
True

    <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
            <param name="search">sourcetype="firewall" Attack_Description !=NULL | eval ip_port = app_ip +":"+ app_port | where ip_port = "$service_ipport$" |stats count BY Attack_Severity</param>
            <module name="JobProgressIndicator"/>
            <module name="HiddenChartFormatter">
                    <param name="chartTitle">Attacks with Custom Severity - Count</param>
                    <param name="chart">pie</param>
                    <module name="FlashChart">
                            <param name="width">100%</param>
                            <param name="height">360px</param>
                            <module name="ConvertToDrilldownSearch">
                                    <module name="ViewRedirector">
                                            <param name="viewTarget">flashtimeline</param>
                                            <param name="popup">true</param>
                                    </module>
                            </module>
                    </module>
            </module>
    </module>






Please help !!
Thanks !!!

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Get the UI Examples app from Splunkbase if you haven't already.

There's an example in there showing a SearchSelectLister that responds to an intention from a module above. Advanced XML > Lister Examples > 2 listers driving multiple elements.

Technically the example shows a StaticSelect above and a SearchSelectLister below, but it's the second one that's wrong here.

Short version -- you're missing the following param on your SearchSelectLister.

<param name="applyOuterIntentionsToInternalSearch">True</param>

but go back and read the UI Examples example because there may be other problems here that you can clear up by returning to docs/examples for a bit. (I'm very rusty with the listers because the Sideview Utils app replaces them with its Pulldown module, and removes intentions from the picture entirely. )

View solution in original post

sideview
SplunkTrust
SplunkTrust

Get the UI Examples app from Splunkbase if you haven't already.

There's an example in there showing a SearchSelectLister that responds to an intention from a module above. Advanced XML > Lister Examples > 2 listers driving multiple elements.

Technically the example shows a StaticSelect above and a SearchSelectLister below, but it's the second one that's wrong here.

Short version -- you're missing the following param on your SearchSelectLister.

<param name="applyOuterIntentionsToInternalSearch">True</param>

but go back and read the UI Examples example because there may be other problems here that you can clear up by returning to docs/examples for a bit. (I'm very rusty with the listers because the Sideview Utils app replaces them with its Pulldown module, and removes intentions from the picture entirely. )

ranjyotiprakash
Communicator

Thanks a lot !!!!

0 Karma

sideview
SplunkTrust
SplunkTrust

Well, one thing that springs out, is that the search populating the dropdown has a field called "ipport", but the dropdown itself is looking for a field called "service_ipport", which will then never be there. But in general, yes my advice is to crib from the working examples in the UI Examples app. By working backwards and comparing you can always find where things have gone off track.

ranjyotiprakash
Communicator

I tried that already but, the seconnd dropdown was not getting populated. So I removed that just to check whether it is getting loaded when individual search is done . But, even in this case as well it is not getting loaded. Is any thing else that I can look to solve this problem ? Thanks !!

0 Karma

ranjyotiprakash
Communicator

Am i missing something ?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...