Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Advance XML

$
0
0

Recently I created an app which includes a an inputlookup. (We actually stole this one from the Webintelligence app):

<module name="SearchSelectLister" layoutpanel="mainSearchControls"> <param name="settingToCreate">domain_setting</param> <param name="search"> | inputlookup sourcenames.csv | stats values(source) as source by sourcename</param>

We use this later to “addterm” into inline searches:

<module name="ConvertToIntention">
  <param name="settingToConvert">domain_setting</param>
  <param name="intention">
    <param name="name">addterm</param>
    <param name="arg">
      <param name="uri">$target$</param>
    </param>

In general this works fine. Now my problem is that my inputlookup can create multi-value fields. What my SearchSelectLister is doing now is, that I have one Dropdown-Entry for every value of the multi-value field. What I want have is one Dropdown entry and put the addterm into the search including the multi-value field. In our case we are filtering out web-access-logs for certain entries with certain uri’s.


Viewing all articles
Browse latest Browse all 13053

Trending Articles