Implementing Splunk 7, Third Edition - Third Edition

stringreplace

This is the most common intention to use and maps directly to the only available action in simple XML-variable replacement. Let's look at our search field from our advanced XML example:

<module name="ExtendedFieldSearch" layoutPanel="viewHeader"> 
<param name="replacementMap"> 
<param name="arg"> 
<param name="user"/> 
</param> 
</param> 
<param name="field">User</param> 
<param name="intention"> 
<param name="name">stringreplace</param> 
<param name="arg"> 
<param name="user"> 
<param name="fillOnEmpty">True</param> 
</param> 
</param> 
</param> 

Stepping through the param instances, we have the following terms and their descriptions:

• field: This is the label for the field displayed in the dashboard.
• replacementMap: This parameter names ...