I think the only problem is that you're using Sideview modules, but then you're still trying to use intentions. Sideview's Search module will do its own $foo$ replacement, and after that your stringreplace intention will have nowhere to go.
Fix is surprisingly simple.
1) Dont use the ConvertToIntention module at all. Delete it.
2) Just put $click.name2$ directly into the Search - dont use $url$ at all.
Here's a copy of the cleaned up XML.
<view template="dashboard.html">
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
<param name="search">index=webping sourcetype=webping | timechart span=2m avg(time_in_ms) as avg by ping_url | fields - OTHER</param>
<param name="earliest">-1h</param>
<module name="JobProgressIndicator"/>
<module name="HiddenChartFormatter">
<param name="charting.chart">line</param>
<module name="FlashChart">
<param name="width">100%</param>
<param name="height">160px</param>
<param name="enableResize">False</param>
<module name="Search">
<param name="search">index="01_firewall" sourcetype="01_firewall"
[search index=webping | rename ping_url as url| dedup url| fields url| search $click.name2$
| join type=left url [SEARCH index="lookup" sourcetype="url_info" earliest=-24h] | fields - _time |rename ip_addr as search]
| fields SourceIP DestinationIP Count Action PacketSize
| eval ip_addr = [search index=webping | rename ping_url as url| dedup url| fields url| search $url$
| join type=left url [SEARCH index="lookup" sourcetype="url_info" earliest=-24h] | fields - _time | fields ip_addr
| eval ip_addr="\"".ip_addr."\"" | rename ip_addr as search]
| search
| eval attackerIP=case(SourceIP==ip_addr , DestinationIP , DestinationIP==ip_addr , SourceIP,1==1,"NOT")
|search NOT attackerIP="NOT" | geoip attackerIP | table attackerIP Count attackerIP_country_name Action PacketSize
</param>
<param name="earliest">-15m</param>
<module name="JobProgressIndicator"></module>
<module name="SimpleResultsTable">
<param name="count">20</param>
</module>
</module>
</module>
</module>
</module>
</view>
I have some other suggestions about your searches, although that's not what you're asking about --
Extra1: You might want to also rewrite your search that begins with:
[search index=webping | rename ping_url as url| dedup url| fields url| search $click.name2$
as
[search index=webping $click.name2$ | rename ping_url as url| dedup url| fields url
as this will have considerably better performance. The first version gets everything off disk and only then filters based on the searchterms. Actually if you're using a relatively recent 2.2.X version of Sideview Utils you can just use $click.searchTerms$ instead of $click.name2$
Bonus2: You may also want to think about rewriting this:
search index=webping $click.name2$ | rename ping_url as url| dedup url| fields url
| join type=left url [SEARCH index="lookup" sourcetype="url_info" earliest=-24h] | fields - _time |rename ip_addr as search]
as something more like:
search (index="webping" $click.searchTerms$ ) OR ( index="lookup" sourcetype="url_info" | stats last(ip_addr) as ip_addr by url | rename ip_addr as search
because as a disjunction it'll give you much better performance than join and you wont hit limits in number of rows or length of execution.
... View more