Building Advanced Dashboards - Implementing Splunk: Big Data Reporting and Development for Operational Intelligence - page 211

Using intentions
Intentions allow you to affect downstream searches, using values provided by other
modules, for instance, form fields or the results of a click. There are a number of
available intention types, but we will cover the two most common, stringreplace
and addterm . You can see examples of other types of intentions in the UI Examples
app available at http://splunkbase.com .
stringreplace
This is the most common intention to use, and maps directly to the only available
action in simple XML—variable replacement. Let's look at our search field from our
advanced XML example:
<module name="ExtendedFieldSearch" layoutPanel="viewHeader">
<param name="replacementMap">
<param name="arg">
<param name="user"/>
</param>
</param>
<param name="field">User</param>
<param name="intention">
<param name="name">stringreplace</param>
<param name="arg">
<param name="user">
<param name="fillOnEmpty">True</param>
</param>
</param>
</param>
Stepping through the params we have:
• field : This is the label for the field displayed in the dashboard.
• replacementMap : This parameter names the variable that the
ExtendedFieldSearch module is creating. I have been told that the
nested nature means nothing, and we should simply copy and paste
the entire block of XML, changing nothing but the value of the deepest
param , in this case to user .
• intention : Intentions have specific structures that build blocks of query
from a structured XML. In the case of stringreplace (which is the most
common use case), we can essentially copy the entire XML and once again
change nothing but the value of the third-level param , which is currently
user . fillOnEmpty determines whether to make the substitution when
the user variable is empty.