Splunk Search
Highlighted

Second dropdown is not getting populated ??

Communicator

I am using two dropdowns in a view in my applicationa. First drop down is getting populated and I want the second dropdown to get populated based on the item selected in first drop down. But, the second dropdown is not getting populated.

I am posting the code here :
enter code here




*
False
1


dashboard


Select the Box Unit Name from the Drop-Down Menu


True
unamesetting
Unit Name :
test search


unit
name
unitname



unamesetting

stringreplace


$target$


            <module name="SearchSelectLister" layoutPanel="panel_row1_col1" autoRun="True">
                    <param name="searchWhenChanged">True</param>
                    <param name="settingToCreate">service_setting</param>
                    <param name="label">Service :</param>
                    <param name="search">sourcetype="firewall" | eval ip_port = app_ip +":"+ app_port | chart count over ip_port</param>
                    <param name="searchFieldsToDisplay">
                            <list>
                                    <param name="label">service_ipport</param>
                                    <param name="value">service_ipport</param>

                            </list>
                    </param>
                    <module name="ConvertToIntention">
                            <param name="settingToConvert">service_setting</param>
                            <param name="intention">
                                    <param name="name">stringreplace</param>
                                    <param name="arg">
                                            <param name="service_ipport">
                                                    <param name="value">$target$</param>
                                            </param>
                                    </param>
                            </param>


    <module name="StaticContentSample" layoutPanel="panel_row1_col1">
            <param name="text">You can adjust the time range of the audit reports
                    by selecting your desired time using the picker below.</param>
    </module>


Last 60 minutes
True

    <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="True">
            <param name="search">sourcetype="firewall" Attack_Description !=NULL | eval ip_port = app_ip +":"+ app_port | where ip_port = "$service_ipport$" |stats count BY Attack_Severity</param>
            <module name="JobProgressIndicator"/>
            <module name="HiddenChartFormatter">
                    <param name="chartTitle">Attacks with Custom Severity - Count</param>
                    <param name="chart">pie</param>
                    <module name="FlashChart">
                            <param name="width">100%</param>
                            <param name="height">360px</param>
                            <module name="ConvertToDrilldownSearch">
                                    <module name="ViewRedirector">
                                            <param name="viewTarget">flashtimeline</param>
                                            <param name="popup">true</param>
                                    </module>
                            </module>
                    </module>
            </module>
    </module>






Please help !!
Thanks !!!

0 Karma
Highlighted

Re: Second dropdown is not getting populated ??

Communicator

Am i missing something ?

0 Karma
Highlighted

Re: Second dropdown is not getting populated ??

SplunkTrust
SplunkTrust

Get the UI Examples app from Splunkbase if you haven't already.

There's an example in there showing a SearchSelectLister that responds to an intention from a module above. Advanced XML > Lister Examples > 2 listers driving multiple elements.

Technically the example shows a StaticSelect above and a SearchSelectLister below, but it's the second one that's wrong here.

Short version -- you're missing the following param on your SearchSelectLister.

<param name="applyOuterIntentionsToInternalSearch">True</param>

but go back and read the UI Examples example because there may be other problems here that you can clear up by returning to docs/examples for a bit. (I'm very rusty with the listers because the Sideview Utils app replaces them with its Pulldown module, and removes intentions from the picture entirely. )

View solution in original post

Highlighted

Re: Second dropdown is not getting populated ??

Communicator

I tried that already but, the seconnd dropdown was not getting populated. So I removed that just to check whether it is getting loaded when individual search is done . But, even in this case as well it is not getting loaded. Is any thing else that I can look to solve this problem ? Thanks !!

0 Karma
Highlighted

Re: Second dropdown is not getting populated ??

SplunkTrust
SplunkTrust

Well, one thing that springs out, is that the search populating the dropdown has a field called "ipport", but the dropdown itself is looking for a field called "service_ipport", which will then never be there. But in general, yes my advice is to crib from the working examples in the UI Examples app. By working backwards and comparing you can always find where things have gone off track.

Highlighted

Re: Second dropdown is not getting populated ??

Communicator

Thanks a lot !!!!

0 Karma