Dashboards & Visualizations

Nested intentions

cphair
Builder

Hello,

This may be similar to http://splunk-base.splunk.com/answers/2218/adding-intention-to-second-drilldown-search. I have a dashboard with the pattern SearchSelectLister->ConverttoIntention->ConditionalSwitcher->HiddenSearch. I wanted to add a second intention before the switcher, so I stuck an ExtendedFieldSearch just before it. The result was that neither intention was substituted into the HiddenSearch; I was stuck with the $foo$ text. I changed the ExtendedFieldSearch to another SearchSelectLister->ConverttoIntention, to get a dropdown instead of freeform entry, and that worked. Did the ExtendedfieldSearch somehow consume the original intention? In general, how long do intentions stick around--are they only converted when they hit a search module, and does it matter whether they're stringreplace or addterm?

UPDATE: I tried to reproduce this problem on an example dashboard and couldn't. However, on this sample dashboard, the ExtendedFieldSearch only works when it's a child of the search module I'm substituting for. The SearchSelectLister works as the search's parent. Why is this? I find it more intuitive for the intention modules to contain the searches, and I'd prefer to do it that way for all intentions if ExtendedFieldSearch can be used like that.

Tags (2)
0 Karma

melting
Splunk Employee
Splunk Employee

If you could provide your xml I can try to reproduce and see if we can get it to work with ExtendedFieldSearch.

0 Karma

melting
Splunk Employee
Splunk Employee

Intentions stick around until they are clobbered by another intention of the same name, or until they are used in a search. Both stringreplace and addterm should act the same.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...