Splunk Search

searchFieldsToDisplay order

timmalos
Communicator

I cant manage to find a way to order my select as I want.
I got this script:

        <module name="SearchSelectLister" layoutPanel="viewHeader" autoRun="True">
            <param name="searchFieldsToDisplay">
                <list>
                    <param name="value">Name</param>
                    <param name="label">Name</param>
                </list>
                <list>
                    <param name="value">Id</param>
                    <param name="label">Id</param>
                </list>
            </param>

My problem is that the values in the pulldown are shown in this order : Name1, Id1, Name2, Id2, Name3, Id3 etc... I would the following order : Name1, Name2, Name3,...Name N, Id1, Id2,...IdN

Is it possible?

0 Karma
1 Solution

timmalos
Communicator

I got around my problem and did a search that returns both Name and Id in a same field (Sorted like i wanted) so that I can have only one list in my searchFieldsToDisplay module.

index="infra_vmware" $host$ earliest=-2h latest=now|dedup Id| eval Id=Id+","+Name)|table Id| makemv delim="," Id|mvexpand Id|sort Id

Don't know if it's the best solution, but works 🙂

View solution in original post

0 Karma

timmalos
Communicator

I got around my problem and did a search that returns both Name and Id in a same field (Sorted like i wanted) so that I can have only one list in my searchFieldsToDisplay module.

index="infra_vmware" $host$ earliest=-2h latest=now|dedup Id| eval Id=Id+","+Name)|table Id| makemv delim="," Id|mvexpand Id|sort Id

Don't know if it's the best solution, but works 🙂

0 Karma
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...

Purpose in Action: How Splunk Is Helping Power an Inclusive Future for All

At Cisco, purpose isn’t a tagline—it’s a commitment. Cisco’s FY25 Purpose Report outlines how the company is ...

[Upcoming Webinar] Demo Day: Transforming IT Operations with Splunk

Join us for a live Demo Day at the Cisco Store on January 21st 10:00am - 11:00am PST In the fast-paced world ...