how to get my search to read my pulldown value?

[rhayle]

I pass through a myPulldownName value for the URLLoader, which is the selected value for the pulldown. I then want the pulldown to pass this found value to my search.
My question is how do I get my search to read my pulldown value?

e.g.

    <view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
  <label>abc</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="SideviewUtils" layoutPanel="appHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="TimeRangePicker" layoutPanel="viewHeader" autoRun="True">
      <param name="searchWhenChanged">True</param>
      <module name="HiddenSearch" layoutPanel="viewHeader">
        <param name="search">| savedsearch t24_ofs_source_list</param>      
        <module name="Pulldown">
          <param name="label">Select OFS Source</param>
          <param name="name">myPulldownName</param>
          <param name="searchFieldsToDisplay">
            <list>
              <param name="value">OFS_Source</param>
              <param name="label">OFS_Source</param>
            </list>
          </param>


        <module name="HiddenSearch" layoutPanel="panel_row1_col1" group="Elapsed Time">
          <param name="search">| savedsearch t24_transaction OFS_Source="$OFS_Source$"</param>
          <module name="HiddenChartFormatter">
            <param name="chart">column</param>
            <param name="chart.stackMode">stacked</param>
            <param name="charting.axisTitleX.text">Time</param>
            <param name="charting.axisTitleY.text">Elapsed Time (Seconds)</param>
            <param name="charting.labels">MessageID</param>
            <module name="JSChart">
              <module name="ConvertToDrilldownSearch">
                <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                </module>
              </module>
            </module>
          </module>
          <module name="JobProgressIndicator"/>
        </module>
      </module>
    </module>
  </module>
  </module>
</view>

[sideview · Accepted solution]

Well the main problem is that you're using the core Splunk HiddenSearch module instead of the Search module.

Replace that with the Search module and it'll work fine. Search can do $foo$ replacement directly, but HiddenSearch can only use the stringreplace intentions to replace $foo$ tokens, and that's a whole different kettle of fish.

There is also a secondary issues here though which you should fix before you proceed. As you read down into the nested XML, you have a second autoRun="true" there. This is very bad as it can create unpredictable behavior and it exposes you to a class of bugs. Remove the more downstream of the two autoRun="true" attributes. In general you should never under any circumstances have an autoRun="true" that is nested inside another one. Also after you take that out, scan through your other views to make sure the same problem isn't happening over there. The symptoms of this will include views that seem to load incorrectly as though some elements were missing, or as though some elements were outputting null values.

[rhayle]

I tested the pulldown on its own with OFS_Source name and it worked, I then changed the URL param to OFS_Source and now that works too. Thanks!

[sideview]

Well I'm not sure what's going on with your two different names "myPulldownName" and "OFS_Source". Assuming OFS_Source is the name you want, just remove "myPulldownName" entirely and replace it with "OFS_Source". Whenever a Sideview module has a param called "name", this determines what $foo$ values it will output for downstream modules. So if it's called "myPulldownName", then you would only be able to reference it using $myPulldownName$ and $myPulldownName.rawValue$, etc.. However for many reasons the best practice is to use the actual field name, so I recommend using "OFS_Source".

[rhayle]

I changed it to search and removed the autoRun from the URLLoader. However no difference, OFS_Source is still empty.

table MessageID, OFS_Source, ElapsedTime | where ElapsedTime > 0 AND OFS_Source=""

Any other suggestions?