Refine your search:

1
1

I could not find an example for adding a dropdown field in advanced view.

In my advanced view I would like to replace the regular input field with a drowpdown holding the field names on which the user can execute searches. Example: User selects B_NUMBER in dropdown and in the input field types 02155555.

(B_NUMBER="02155555" to search)

Currently I use the following view to search on 2 fields.

<view template="dashboard.html"  onunloadCancelJobs="False" autoCancelInterval="100">  
    <label>client custom search</label>
    <module name="HiddenSearch" layoutPanel="panel_row2_col1" autoRun="true">
        <param name="search">search host=client_transformed index=client  A_NUMBER=$anum$ B_NUMBER=$bnum$ | fields I/O  A_NUMBER A_NUMBER_NAMED  B_NUMBER B_NUMBER_NAMED DATE TIME LOCATION BAND DURATION CPM  ex_vatcharge  | fields - _time</param>
        <module name="ExtendedFieldSearch">
            <param name="intention">
                <param name="name">stringreplace</param>
                <param name="arg">
                    <param name="anum">
                        <param name="default">*</param>
                    </param>
                </param>
            </param>
            <param name="replacementMap">
                <param name="arg">
                    <param name="anum">
                        <param name="value"></param>
                    </param>
                </param>
            </param>
            <param name="field">ANUMBER</param>
            <module name="ExtendedFieldSearch">
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="bnum">
                            <param name="default">*</param>
                        </param>
                    </param>
                </param>
                <param name="replacementMap">
                    <param name="arg">
                        <param name="bnum">
                            <param name="value"></param>
                        </param>
                    </param>
                </param>
                <param name="field">BNUMBER</param>
                <module name="Paginator">
                    <param name="count">20</param>
                    <param name="entityName">results</param>
                    <param name="maxPages">10</param>
                    <module name="SimpleResultsTable">
                    </module>
                </module>
            </module>
        </module>
    </module>
</view>

asked 16 Apr '10, 12:57

imrago's gravatar image

imrago
68529
accept rate: 35%


3 Answers:

First off, I'm curious about why you're trying to do this in the advanced XML? It's much easier in the simplified XML but there might be something specific you're trying to accomplish by using the advanced XML. What is that?

Now, to answer your question. If I take one of the simplified XML views from the UI examples that includes dropdowns, then append ?showsource=true to the URI, I can see the advanced XML behind the dropdowns. It looks like:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleForm" onunloadCancelJobs="true" template="dashboard.html">
 <label>Simple select drop down</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="HiddenSearch" layoutPanel="viewHeader">
    <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</param>
    <param name="earliest">-30d</param>
    <param name="latest">-0d</param>
      <module name="SearchSelectLister">
        <param name="staticFieldsToDisplay">
         <list>
          <param name="value">*</param>
          <param name="label">Any</param>
         </list>
       </param>
       <param name="search">index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series</param>
       <param name="label">Select series</param>
       <param name="settingToCreate">series_setting</param>
       <param name="searchFieldsToDisplay">
        <list>
         <param name="value">series</param>
         <param name="label">series</param>
        </list>
       </param>
       <param name="searchWhenChanged">False</param>
        <module name="ConvertToIntention">
         <param name="settingToConvert">series_setting</param>
         <param name="intention">
           <param name="name">stringreplace</param>
           <param name="arg">
             <param name="series">
              <param name="fillOnEmpty">True</param>
              <param name="value">$target$</param>
            </param>
          </param>
         </param>
         <module name="SubmitButton">
          <param name="allowSoftSubmit">True</param>
          <param name="label">Search</param>
           <module name="JobStatus">
            <module name="EnablePreview" layoutPanel="panel_row1_col1" group="Matching events">
             <param name="groupLabel">Matching events</param>
             <param name="enable">True</param>
             <param name="display">False</param>
              <module name="SimpleResultsTable">
               <param name="count">50</param>
               <param name="drilldown">row</param>
               <param name="allowTransformedFieldSelect">True</param>
                <module name="ConvertToDrilldownSearch">
                 <module name="ViewRedirector">
                  <param name="viewTarget">flashtimeline</param>
                 </module>
                </module>
              </module>
             <module name="ViewRedirectorLink">
              <param name="viewTarget">flashtimeline</param>
             </module>
        </module>
      </module>
    </module>
  </module>
</module>

link

answered 16 Apr '10, 18:45

emma's gravatar image

emma ♦
7331412
accept rate: 42%

The reason i am using advanced XML is because I want to have this form-search on the left column of my dashboard, and another form-search on the right column. Or is there another way to do this (2 columns dashboard) without using advanced xml?

link

answered 06 Apr '11, 14:53

klee310's gravatar image

klee310
10314
accept rate: 0%

If you want two columns then you need to look at the attribute 'layoutPanel'

e.g

<module name="StaticContentSample" layoutpanel="panel_row1_col1">

then do for two columns you need another two with the following;

layoutPanel="panel_row2_col1" layoutPanel="panel_row2_col1"

link

answered 30 Jun '11, 07:37

Wushu's gravatar image

Wushu
211
accept rate: 33%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×157

Asked: 16 Apr '10, 12:57

Seen: 946 times

Last updated: 30 Jun '11, 07:37

Copyright © 2005-2012 Splunk, Inc. All rights reserved.