SearchSelectLister not passing values

[yxr8011]

I have two dropdowns and want to get the selected value pass to the panel, but it shows this on the top:
"Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the left hand side."

Also when I clicked "inspect", it says: This search did not successfully execute. Any results returned from this job are not consistent and should not be used.
search index=nagios sourcetype=nagiosserviceperf host= name=read_job_245

Which means $host$ hasn't pass any values to host. The xml I have is below. Please give some advice on this, thanks.

 <module name="SearchSelectLister" layoutPanel="viewHeader" autoRun="False">
<param name="staticFieldsToDisplay"/>
<param name="savedSearch">list nagios hosts</param>
<param name="label">Host</param>
<param name="settingToCreate">host_setting</param>
<param name="searchFieldsToDisplay">
  <list>
    <param name="value">host</param>
    <param name="label">host</param>
  </list>
</param>
<param name="searchWhenChanged">True</param>
<module name="ConvertToIntention">
  <param name="settingToConvert">host_setting</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="host">
        <param name="value">$target$</param>
      </param>
    </param>
  </param>            
     <module name="SearchSelectLister">
        <param name="searchWhenChanged">True</param>
        <param name="settingToCreate">id_setting</param>
        <param name="applyOuterIntentionsToInternalSearch">True</param>
        <param name="search">index="nagios" sourcetype=nagiosserviceperf host=$host$| top 111  name | fields name | sort name</param>
        <param name="label">JobID</param>
        <param name="searchFieldsToDisplay">
          <list>
            <param name="value">name</param>
            <param name="label">name</param>
          </list>
        </param>
         <module name="Search" layoutPanel="panel_row1_col1">
         <param name="search"> index=nagios sourcetype=nagiosserviceperf host=$host$ name=read_job_*| timechart max(success_rate) max(success_threshold) span=5m</param>
        <module name="FlashChart">
        <module name="HiddenChartFormatter">
        <module name="FlashChart">
         <param name="drilldownPrefix">click2</param>
        </module>
        </module>
        </module>
        </module>
    </module>
</module>

[sideview · Accepted solution]

The only piece of Sideview Utils that you're actually using here is the Search module, and the problem you're having has to do with limitations and funkiness of the Splunk SearchSelectLister module, so I think the best first step is to convert these other modules to Sideview modules so as to simplify the view.

I took a quick stab at converting to Pulldown etc.

<module name="SavedSearch" layoutPanel="viewHeader" autoRun="True">
  <param name="name">list nagios hosts</param>

  <module name="Pulldown">
    <param name="name">host</param>
    <param name="label">Host</param>
    <param name="template">$name$="$value$"</param>
    <param name="valueField">$name$</param>
    <param name="staticOptions"></param>

    <module name="Search" layoutPanel="viewHeader">
      <param name="search">index="nagios" sourcetype=nagiosserviceperf $host$ | top 111  name | fields name | sort name</param>

      <module name="Pulldown">
        <param name="name">JobId</param>
        <param name="label">JobId</param>
        <param name="template">name="read_job_$value$"</param>
        <param name="valueField">name</param>

        <module name="Search" layoutPanel="panel_row1_col1">
          <param name="search"> index=nagios sourcetype=nagiosserviceperf $host$ JobId | timechart max(success_rate) max(success_threshold) span=5m</param>

          <module name="ValueSetter">
            <param name="arg.charting.chart">line</param>

            <module name="FlashChart" />
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

As you can see the view is a lot simpler.

Now, the problem you were having was that if/when the selected host is blank, the search string ended up with a "host=" with no value on the right hand side. that's what the syntax error was telling you - that you were sending invalid search language to splunkd.

The way you handle this case with the Sideview Pulldown module and other Sideview form modules is to use their "template" param. If/when the user's selection amounts to null input, the templated part will always dissappear from the search thus not leaving any invalid syntax.