Dashboards & Visualizations

StaticSelect/stringreplace

LauraBre
Communicator

Hello,

I actually create a view where I want to propose user a pulldown menu and replace in my search the value selected by the user in the menu but I don't do it because I want to use the StaticSelect module but it doesn't work with the intention stringreplace.

Thanks by advance to your help,

<view>  

<module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">host="Laura-PC" |stats $st$</param>

   <module name="ExtendedFieldSearch">

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">count</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Param</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module>

</view>

This is my pulldown module :

<module name="StaticSelect">
<param name="settingToCreate">Requester</param><param name="label">field:</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">fr18126</param>
<param name="value">fr18126</param>
</list>
<list>
<param name="label">a187571</param>
<param name="value">a187571</param>
</list>
</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

Well, I'm not entirely sure of the details, but it seems to me like you're asking how you can take a StaticSelect module and incorporate it into the existing XML where you have a TextField and a HiddenSearch module.

Here's my attempt at doing that, in just the core XML. Note that while ExtendedFieldSearch has its own weird syntax for specifying "intentions", with the "lister" modules as well as with the StaticSelect module, you have to use the ConvertToIntention module, which has its own weird, different syntax.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">field:</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="Requester">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="st">
                  <param name="default">count</param>
                  <param name="value"></param>
              </param>
          </param>
        </param> <!-- End param intention-->

        <param name="replacementMap">
          <param name="arg">
            <param name="st">
                <param name="value"></param>
            </param>
          </param>
        </param> <!-- End param replacementMap -->

        <param name="field">Param</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

For fun I also threw together an example showing the same functionality but built using the modules in Sideview Utils. Here you'll see a static Pulldown module and a simple TextField module, doing exactly the same thing as the above view, but using Sideview Utils.

As you can see, things come out a lot shorter, easier and maybe even a bit more intuitively in Sideview Utils. In any event you wont have to think about 'intentions' anymore ever.

<module name="SideviewUtils" layoutPanel="appHeader" />

<module name="Pulldown" layoutPanel="mainSearchControls">
  <param name="name">Requester</param>
  <param name="label">field:</param>
  <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="TextField">
      <param name="name">st</param>
      <param name="label">Param</param>

      <module name="Search" layoutPanel="mainSearchControls">
        <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

There are other strange things about this view, but for the sake of brevity I wont comment on them since they don't pertain to your actual question.

Lamar
Splunk Employee
Splunk Employee

It's a little unclear why you have your static select separated from your advanced XML above. And since positioning the StaticSelect inside your XML is important this could be causing some issues. Can you post your entire XML file for this dashboard?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...