Pulldown Module: Create two sets of outerTemplate

[cmak]

I would like to have only 1 pulldown, and have it generate two result tables. I would like to allow multiple selection as well. In order to generate my $foo$ variables, the module has template, separator, and outertemplate. However, in order to create my 2 different results, I would need to have two different templates, separator and outer templates created as the search queries are different.

How would the XML code for the pulldown module look like to allow two different template/outer template.

As a last resort, i suppose I could simply have 2 separate pulldowns

[sideview · Accepted solution]

If you just need two different "outerTemplate" values, then dont set outerTemplate at all. Leave the Pulldown's outerTemplate param completely unset.

Then downstream from the Pulldown but upstream from the places where you need the key, stitch in 2 ValueSetter modules.

Let's say that your Pulldown module has

<param name="name">myPulldown</param>

then you would have these as your ValueSetters:

<module name="ValueSetter">
  <param name="name">firstWay</param>
  <param name="value">NOT ( $myPulldown$ )</param>

  <module name="ValueSetter">
    <param name="name">secondWay</param>
    <param name="value">( $myPulldown$ OR someField="*"* )</param>

    ... at this point and further downstream you can use either 
    $firstWay$ or $secondWay$ in Search or PostProcess modules 
    as necessary and I think this will fit your needs. 

  <module>
</module>

[sideview]

Sideview Utils 2.4 has released, and it has this module. After downloading, installing and restarting Splunk you can navigate to "Module Documentation > Advanced Modules > The ArrayValueSetter module", and there are docs there that talk about pretty much this exact use case, where you want to format two different search expressions from a single multiselect Pulldown.

[cmak]

Yup, I will wait for the next release

[sideview]

Well... you could also do all this from a CustomBehavior. From such a customBehavior, to get the raw array of the multiple selections would be context.get("myPulldown.rawValue"), and you could implement getModifiedContext, monkey with that array as necessary, set two new keys into the context with context.set() and then return that context. But I didn't say that. You'll be happier waiting for the proper module.

[cmak]

Alright, that would be great. I was actually considering huge hacks, such as having multiple hidden dropdowns to create the other variables and to use JavaScript to select the hidden values when values in the original dropdown is selected. Not sure if it would work, but super hacky.

[sideview]

OK. I haven't decided yet whether it's additional template/separator/outerTemplate params on ValueSetter, or whether it's a separate module called something like MultiValueSetter. But I'll post back here when the next Utils is out and it should make it into that release.

[cmak]

Yup, sounds good 🙂

[sideview]

hah. Well then the answer is more complicated and you'll have to use the new "MultiValueSetter" module that by an odd coincidence I am in the process of making. Can you wait a week or two?

[cmak]

I forgot to mention that I also need 2 different templates and 2 different separators as well. Therefore, I would have two completely different variables in the end, not just the outer template.