Implementing Splunk - Second Edition

Using intentions

Intentions allow you to affect downstream searches using values provided by other modules, for instance, form fields or the results of a click. There are a number of available intention types, but we will cover the two most common ones, stringreplace and addterm. You can see examples of other types of intentions in the UI Examples app available at http://splunkbase.com.

stringreplace

This is the most common intention to use and maps directly to the only available action in simple XML—variable replacement. Let's look at our search field from our advanced XML example:

<module name="ExtendedFieldSearch" layoutPanel="viewHeader"> <param name="replacementMap"> <param name="arg"> <param name="user"/> </param> </param> <param name="field">User</param> ...