Why can't I use hiddenFields inside of a Gate?

[kragel]

I'm using Gate and I want to hide some of the fields when the table is displayed. If I'm not inside of a gate, hiddenFields works just fine. I get the following error:

Misconfigured view 'view name here' - Unknown parameter 'hiddenFields' is defined for module Gate. Make sure the parameter is specified in Gate.conf.

Another point to mention is that I would like to table the results if the "dropped" gate is set. If the "not_dropped" gate is set I would like to kick off a new search and not table the results ulitmately. Assuming that is possible. I'm just trying to get the extra fields out of the table at this point.

Not sure if I need to mess with Gate.conf. I don't really know what I'm doing in there so I'm hesitant. Does anyone have any ideas on how fix this or work around it? Thanks.

 <module name="Search">
    <param name="search">$row.fields.pp_msgid$ | rename action as pp_action | eval dropped=case(pp_action=="discard","YES discarded") | eval not_dropped=case(pp_action!="discard","NO not discarded") | rename rule as last_pp_rule | rename _time as int_time | eval timestamp=strftime(int_time, "%m/%d/%y %H:%M:%S:%3N %p") | table timestamp,subject,pp_action,last_pp_rule,qid,dropped,not_dropped</param>
    <module name="ResultsValueSetter">
      <param name="fields">dropped,not_dropped</param>
      <module name="Gate">
        <param name="requiredKeys">dropped</param>
        <module name="HTML" layoutPanel="panel_row1_col1">
          <param name="html">
            <![CDATA[<h2>Processed selection dropped....</h2>]]>
          </param>
        </module>
        <module name="Table" />
          <param name="hiddenFields">dropped,not_dropped</param>
      </module>
      <module name="Gate">
        <param name="requiredKeys">not_dropped</param>
        <module name="HTML" layoutPanel="panel_row1_col1">
          <param name="html">
            <![CDATA[<h2>The message was not dropped....</h2>]]>
          </param>
        </module>
        <module name="Table" />
          <param name="hiddenFields">dropped,not_dropped</param>
      </module>

[sideview · Accepted solution]

The problem is that if you look at your XML carefully, you're putting the "hiddenFields" param inside the Gate module, NOT inside the Table module.

Look carefully at these three lines:

<module name="Table" />
  <param name="hiddenFields">dropped,not_dropped</param>
</module>

The module tag for the Table module is actually closed right there - note the trailing "/>". This means that the <param name="hiddenFields"> tag is inside the Gate module, not inside the Table. Other than that mistake the code is actually syntactically correct, and aside from the indentation on the hiddenFields param, even the whitespace is accurate.

Remove that / from your Table module tag, and put an appropriate </module> at the end to replace what it was doing, and then your hiddenFields param will be in the right module.

[kragel]

Wow, nice catch! I was going round and round and missed that. Removed the / and everything works now. You made my day. Thanks!

[kragel]

Here's my code if it helps to show what I'm trying to do. Are you telling me that I need to put my Table and hiddenFields outside of the Gate?

[sideview]

Sounds like you've put the Table module's "hiddenFields" param inside the Gate module instead. Note also that the Sideview Utils app has a lot of documentation for how to use the modules, including overview docs for how the XML works, and pages specifically about Gate and Table.

Can you paste your XML inline or put it on pastebin?

Definitely do not mess with Gate.conf. (Splunk's error message there is suggesting that you're a developer who has forgotten to put a param in a conf file, whereas 99.99% of the time you're a user with a misplaced or mistyped param name.)