All Apps and Add-ons

Pulldown default selection using ValueSetter

kenchisho
Path Finder

Hi guys,

I am trying to use the ValueSetter module to populate default values to a multi-select Pulldown module... the purpose is to provide the users with a simple option to hide fields from certain tables with a lot of columns... the code sample is shown bellow

<module name="ValueSetter" >
   <param name="delim">,</param>
   <param name="name">field_filter</param>
   <param name="value ">Field1,Field2,Field3,Field4,Field5</param>
   <module name="Pulldown">
      <param name="size">2</param>
      <param name="separator">+</param>
      <param name="searchFieldsToDisplay">
         <list>
            <param name="value">field_filter</param>
            <param name="label">field_filter</param>
         </list>
      </param>
      <param name="name">field_filter</param>
      <param name="label">Hidden Fields</param>
   </module>
</module>

I have a search with a "| fields - $field_filter$" at the end

When i save the view with the above ValueSetter module it breaks the view and splunk cannot find/display it...

any ideas... or maybe a better way of getting this done?

sideview
SplunkTrust
SplunkTrust

One problem that I see, is that where you specify the "value" param, you actually have a space character after value so it's technically the "value " param. However this would be throwing a much more problematic error and breaking the view, so maybe that's just a typo.

I tried this out very quickly and it seems to work fine. Note that I also chucked an HTML module in there to debug. This can be a very good quick and dirty tool and save you the time of fishing dispatched search language out of HTTP posts with Firebug...

<module name="ValueSetter" >
  <param name="delim">,</param>
  <param name="name">field_filter</param>
  <param name="value">Field1,Field2,Field3,Field4,Field5</param>

  <module name="Pulldown">
    <param name="name">field_filter</param>
    <param name="label">Hidden Fields</param>
    <param name="size">5</param>
    <param name="separator">+</param>
    <param name="searchFieldsToDisplay">
       <list>
          <param name="value">field_filter</param>
          <param name="label">field_filter</param>
       </list>
    </param>

    <module name="Search">
      <param name="search">foo | fields $field_filter$</param>

      <module name="HTML">
        <param name="html"><![CDATA[
          the search is<br>
          $search$<br>
          <br>
          and the field_filter is<br>
          $field_filter$
        ]]></param>
      </module>
    </module>

  </module>
</module>

and for full disclosure, i put all that downstream from the following Search, so I could duplicate the search results that your Pulldown was rendering from...

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="search">| stats count | eval field_filter=split("Field1,Field2,Field3,Field4,Field5,Field6", ",") | mvexpand field_filter</param>
0 Karma

sideview
SplunkTrust
SplunkTrust

Sideview Utils 2.4.8 just released, in which you will find for the first time good documentation and working examples of all the various uses of the ValueSetter module. http://sideviewapps.com/apps/sideview-utils

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...