Intentions allow you to affect downstream searches using values provided by other modules, for instance, form fields or the results of a click. There are a number of available intention types, but we will cover the two most common ones, stringreplace
and addterm
. You can see examples of other types of intentions in the UI examples app available at http://splunkbase.com.
This is the most common intention to use and maps directly to the only available action in simple XML-variable replacement. Let's look at our search field from our advanced XML example:
<module name="ExtendedFieldSearch" layoutPanel="viewHeader"> <param name="replacementMap"> <param name="arg"> <param name="user"/> </param> </param> <param name="field">User</param> <param name="intention"> <param name="name">stringreplace</param> <param name="arg"> <param name="user"> <param name="fillOnEmpty">True<...