Refine your search:

I would like to speed up a dashbaord with big listings of sourcetypes by using one hidden search over the metadata. The sourcetypes should displayed sorted in different groups represented by several SearchLinkListers. Now i tried puttin everything together but it looks like the SearchLinkLister could not use the inital hiddensearch to do a post processing on it. applyOuterIntentionsToInternalSearch and postprocess doesn't help out. At the moment i ended with the code above which produces a SearchLister module SearchLinkLister_0_3_0 was not given a search or a saved search name to power itself and thus cannot render any data. error message.

Is there any way to use a HiddenSearch with a SearchLinkLister?

<view template="dashboard.html" stylesheet="dashboard2.css">
<label>Übersicht 2</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
   <param name="filter">*</param>
   <param name="clearOnJobDispatch">False</param>
   <param name="maxSize">3</param>
</module>
<module name="GenericHeader" layoutPanel="panel_row1_col1">
<param name="label">Process</param>
<module name="HiddenSearch" autoRun="true">
<param name="search">| metadata type=sourcetypes | search totalCount>0 | eval   termkey="sourcetype" | fields sourcetype</param>

<!-- Process -->
        <module name="Paginator" layoutPanel="panel_row1_col1_grp1">
            <param name="count">10</param>
            <param name="entityName">settings</param>
            <param name="maxPages">10</param>
            <module name="SearchLinkLister">
                 <param name="applyOuterIntentionsToInternalSearch">True</param>
                 <param name="postProcess">| where (sourcetype LIKE "process%") AND (not sourcetype LIKE "%int1%") | sort sourcetype</param>
                 <param name="settingToCreate">list1</param>
                 <param name="searchFieldsToDisplay">
                        <list>
                                <param name="label">sourcetype</param>
                                <param name="value">sourcetype</param>
                        </list>
                </param>
                <module name="ConvertToIntention">
                        <param name="settingToConvert">list1</param>
                        <param name="intention">
                                <param name="name">addterm</param>
                                <param name="arg">
                                 <param name="sourcetype">$target$</param>
                                </param>
                        </param>
                        <module name="ViewRedirector">
                                <param name="viewTarget">flashtimeline</param>
                                <param name="uriParam.auto_pause">true</param>
                        </module>
                </module>
            </module>
    </module>
<!-- Process End -->
</module>
</module>
</view>

asked 27 Feb '12, 09:17

jensihnow's gravatar image

jensihnow
816
accept rate: 16%

edited 27 Feb '12, 23:08


One Answer:

Yes, the way SearchLinkLister was designed, you must supply a search to populate it:

<module name="SearchLinkLister">
   <param name="settingToCreate">list1</param>
   <param name="search">| metadata type=sources</param>
   <param name="searchFieldsToDisplay">
     <list>
       <param name="label">source</param>
       <param name="value">source</param>
     </list>
     <list>
       <param name="label">totalCount</param>
       <param name="labelFormat">number</param>
     </list>
   </param>
link

answered 28 Feb '12, 09:07

araitz's gravatar image

araitz ♦
7.9k3925
accept rate: 46%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×77
×16
×14
×4
×4

Asked: 27 Feb '12, 09:17

Seen: 641 times

Last updated: 28 Feb '12, 09:07

Copyright © 2005-2012 Splunk Inc. All rights reserved.