Build a dynamic form search
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Build a dynamic form search
Use dynamic form search to autopopulate a set of radio buttons or drop down list with results from a search. To populate the radio button or drop down options, write a search to run every time you load the page. You can use a saved search to populate drop down list or radio button options in version 4.0.5 and beyond.
Make sure you already understand how to build a simple form search -- dynamic form searches build on top of the simple form search structure.
Configuration
You've already configured a form search as described in the simple form search documentation. Now, just change the inputtype to either dropdown or radiobutton.
For example, to configure a dropdown:
<form>
<label>My form search</label>
<searchTemplate>$username$</searchTemplate>
<fieldset>
<input type= dropdown/>
MORE CONFIGURATION OPTIONS GO HERE (see below)
</fieldset>
<row>
<table>
<title>Users</title>
<option name="showPager">true</option>
</table>
</row>
</form>
If you want to configure a radio button form search, just specify radio. For example:
<form>
<label>My form search</label>
<searchTemplate>$username$</searchTemplate>
<fieldset>
<input type= radio/>
MORE CONFIGURATION OPTIONS GO HERE (see below)
</fieldset>
<row>
<table>
<title>Users</title>
<option name="showPager">true</option>
</table>
</row>
</form>
configuration options
There are more configuration options you'll want to set for your dropdown or radio buttons. For example, a label to appear next to the dropdown or radio buttons, the search to populate the results, etc. None of these options are required by the input type, but you're not going to have a very useful dropdown or radio button set unless you specify some of these. Here are all your options for configuration:
- label = label
- A label to place next to the generated dropdown.
- default = option
- The default option to select. If the default option cannot be found, the first option is selected.
- prefix
- See description for input type="text".
- suffix
- See description for input type="text".
- choice
- Requires a value attribute. eg "bar". A dropdown option declared by the user. These appear in the order they are defined and before any options generated by an underlying search.
- populatingSearch
- A search used to generate fields for the dropdown. Requires the attributes "fieldForValue" and "fieldForLabel". fieldForValue is the field extracted from the populatingSearch and placed in the value of the generated dropdown option. fieldForLabel is the field extracted from the populatingSearch and placed in the label of the generated dropdown.
Dropdown example
<input type="dropdown" token="username">
<label>Select Name</label>
<populatingSearch fieldForValue="suser" fieldForLabel="suser"><![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
| stats count by suser]]></populatingSearch>
<default>nagrin</default>
<choice value="*">Any</choice>
</input>
Radio example
<input type="radio" token="username">
<label>Select Name</label>
<populatingSearch fieldForValue="suser" fieldForLabel="suser"><![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
| stats count by suser]]></populatingSearch>
<choice value="*">Any</choice>
</input>
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 View the Article History for its revisions.