Dashboards & Visualizations

StaticSelect/stringreplace

LauraBre
Communicator

Hello,

I actually create a view where I want to propose user a pulldown menu and replace in my search the value selected by the user in the menu but I don't do it because I want to use the StaticSelect module but it doesn't work with the intention stringreplace.

Thanks by advance to your help,

<view>  

<module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">host="Laura-PC" |stats $st$</param>

   <module name="ExtendedFieldSearch">

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">count</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Param</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module>

</view>

This is my pulldown module :

<module name="StaticSelect">
<param name="settingToCreate">Requester</param><param name="label">field:</param>
<param name="staticFieldsToDisplay">
<list>
<param name="label">fr18126</param>
<param name="value">fr18126</param>
</list>
<list>
<param name="label">a187571</param>
<param name="value">a187571</param>
</list>
</param>
Tags (1)

sideview
SplunkTrust
SplunkTrust

Well, I'm not entirely sure of the details, but it seems to me like you're asking how you can take a StaticSelect module and incorporate it into the existing XML where you have a TextField and a HiddenSearch module.

Here's my attempt at doing that, in just the core XML. Note that while ExtendedFieldSearch has its own weird syntax for specifying "intentions", with the "lister" modules as well as with the StaticSelect module, you have to use the ConvertToIntention module, which has its own weird, different syntax.

<module name="HiddenSearch" layoutPanel="mainSearchControls">
  <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

  <module name="StaticSelect">
    <param name="settingToCreate">Requester</param>
    <param name="label">field:</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="ConvertToIntention">
      <param name="settingToConvert">Requester</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="Requester">
            <param name="value">$target$</param>
          </param>
        </param>
      </param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="st">
                  <param name="default">count</param>
                  <param name="value"></param>
              </param>
          </param>
        </param> <!-- End param intention-->

        <param name="replacementMap">
          <param name="arg">
            <param name="st">
                <param name="value"></param>
            </param>
          </param>
        </param> <!-- End param replacementMap -->

        <param name="field">Param</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

For fun I also threw together an example showing the same functionality but built using the modules in Sideview Utils. Here you'll see a static Pulldown module and a simple TextField module, doing exactly the same thing as the above view, but using Sideview Utils.

As you can see, things come out a lot shorter, easier and maybe even a bit more intuitively in Sideview Utils. In any event you wont have to think about 'intentions' anymore ever.

<module name="SideviewUtils" layoutPanel="appHeader" />

<module name="Pulldown" layoutPanel="mainSearchControls">
  <param name="name">Requester</param>
  <param name="label">field:</param>
  <param name="staticFieldsToDisplay">
      <list>
        <param name="label">fr18126</param>
        <param name="value">fr18126</param>
      </list>
      <list>
        <param name="label">a187571</param>
        <param name="value">a187571</param>
      </list>
    </param>

    <module name="TextField">
      <param name="name">st</param>
      <param name="label">Param</param>

      <module name="Search" layoutPanel="mainSearchControls">
        <param name="search">host="Laura-PC" Requester="$Requester$" | stats $st$</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
    </module>
  </module> 
</module>

There are other strange things about this view, but for the sake of brevity I wont comment on them since they don't pertain to your actual question.

Lamar
Splunk Employee
Splunk Employee

It's a little unclear why you have your static select separated from your advanced XML above. And since positioning the StaticSelect inside your XML is important this could be causing some issues. Can you post your entire XML file for this dashboard?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...