Dashboards & Visualizations

Text formfield inverted flow in advanced xml example?

hiddenkirby
Contributor

A while back i asked this question http://answers.splunk.com/questions/3606/unicode-object-has-no-attribute-get ... and i couldn't figure out a work around.

I'm curious if anyone as of late has been able to use a form text field to filter a search in a dashboard... using the advanced xml syntax.

thanks, Kirby

Tags (2)
0 Karma
1 Solution

simuvid
Splunk Employee
Splunk Employee

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

View solution in original post

0 Karma

simuvid
Splunk Employee
Splunk Employee

Hi Kirby,

I use following XML Code, which works fine in a Form.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <!-- Define a Hidden Search and replace the $clientip$ token with field value -->
  <param name="search">clientip=$clientip$</param>
  <module name="ExtendedFieldSearch">
   <param name="intention">
   <param name="name">stringreplace</param>
   <param name="arg">
    <param name="clientip">
    <param name="default"></param>
   </param>
  </param>
</param>
<param name="replacementMap">
  <param name="arg">
<param name="clientip">
  <param name="value"></param>
</param>
  </param>
</param>
<param name="field">IP Address</param>

If you like you can sent me your whole xml code and I will review?!

Cheers,

Christian

0 Karma

hiddenkirby
Contributor

it looks like the conversion from simple to advanced xml using the showsource=true .. just incorrectly lined up the modules. Your example shows the EFS before the intention and replacementMap ... the conversion (which produced the error) did EFS -> replacementMap -> intention i simply reordered .. and the error went away.

thank you.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...