Refine your search:

I've a fairly simple report that has a text input field and the report will filter by that input value. For that input field, I'm supposed to use the <extendedfieldsearch> according to the doc. But once I added that tag to my report and tried to run it, I'm getting a 404 error which indicates something is wrong with xml(It'd be nice if splunk could spit out some err msg instead of just throwing a 404). It's not a syntax error because it passed the xml validator on w3school.com.

Here's my xml, any help would be appreciated. thx

<view template="dashboard.html"> <label>zzzzzzzzz</label>
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="navigationHeader" />

<module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
</module>

<module name="GenericHeader" layoutPanel="panel_row1_col1"
    autoRun="True">
    <param name="label">Total Login Report</param>

    <module name="TimeRangePicker" layoutPanel="panel_row1_col1"
        autoRun="True">
        <param name="default">Last 7 days</param>
        <param name="label">Time Range</param>
        <param name="searchWhenChanged">false</param>
        <module name="StaticSelect">
            <param name="label">Browser Type</param>
            <param name="settingToCreate">mop_setting</param>
            <param name="staticFieldsToDisplay">
                <list>
                    <param name="label">All</param>
                    <param name="value">bam</param>
                </list>
                <list>
                    <param name="label">Chrome</param>
                    <param name="value">Chrome</param>
                </list>
                <list>
                    <param name="label">Fire Fox</param>
                    <param name="value">firefox</param>
                </list>
                <list>
                    <param name="label">I.E.</param>
                    <param name="value">msie</param>
                </list>
            </param>
            <param name="selected">All</param>
            <module name="ConvertToIntention">
                <param name="intention">
                    <param name="name">stringreplace</param>
                    <param name="arg">
                        <param name="mop_setting">
                        <param name="value">$mop_setting$</param>
                        </param>
                    </param>
                </param>
                <module name="HiddenSearch" autoRun="True">
<param name="search">source="C:\\tmp\\log4j2.log" userlogin bam "$mop_setting$" | timechart count
        </param>

<module name="ExtendedFieldSearch"> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="st"> <param name="default">bam</param> </param> </param> </param>

                        <param name="replacementMap">
                            <param name="arg">
                        <param name="st">
                        <param name="value"></param>
                                </param>
                            </param>
                        </param> <!-- End param replacementMap -->

                        <module name="SubmitButton">
                    <param name="allowSoftSubmit">False</param>
                            <param name="label">Submit</param>

                            <module name="EnablePreview">
                        <param name="enable">true</param>
                        <param name="display">false</param>

<module name="HiddenChartFormatter"> <param name="chart">column</param> <param name="primaryAxisTitle.text">Time</param>

<param name="secondaryAxisTitle.text">Total Logins</param> <module name="FlashChart"> <param name="width">100%</param> <param name="height">250px</param> </module> <module name="ViewRedirectorLink"> <param name="viewTarget">flashtimeline</param> <param name="label">View results</param>
</module>

</module></module> </module> </module> </module> </module> </module>

    </module><!-- timerange -->
</module><!-- gen. header -->
</view>

asked 19 Apr '12, 08:50

sou128's gravatar image

sou128
614
accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×54
×21

Asked: 19 Apr '12, 08:50

Seen: 304 times

Last updated: 19 Apr '12, 08:50

Copyright © 2005-2012 Splunk Inc. All rights reserved.