PARSER: Applying intentions failed This search cannot be parsed when parse_only is set to true

[Moogz]

Hey All,

I have a search that displays a timechart correctly in the search area but not when I'm trying to display it on a form.

The purpose of the search is to display a timechart from two searches. The subsearch is meant to bring back 1 value that is used as a constant value (kind of like an avg line).

sourcetype=source1 VName="$input1$" LKPA="$input2$" OR LKPZ="$input2$" | fields modID | eval tsInServ = [search sourcetype=source2 SRCA=$input2$ OR SRCZ=$input2$ Status="blah" | stats dc(Entity_ID) AS query] | timechart span=1mon dc(modID),max(tsInServ)

Again, works in the search area, but not when i put it in a form/dashboard - I get the following error and the chart shows up blank

PARSER: Applying intentions failed This search cannot be parsed when parse_only is set to true

Any help would be appreciated!

[sowings]

I too, suffered from the same issue. I've had an extensive dialog with application developers at Splunk, and I finally have this to report.

The core of the issue is that client-side Javascript in the (simple or advanced XML) page is attempting to validate your search string before token substitution, and that parse is failing. You're not even getting to the point of kicking off the search because the Intention system says "no way".

The workaround I was given was to convert the view to advanced XML (if it was in simple XML), and then convert it to using Sideview utils. Personally, for maintainability and ease of use, I'd prefer to stay in simple XML, but Sideview simplifies working with advanced XML quite a bit, and most notably, doesn't suffer from this parsing issue.

Good luck.