Step 2: customize a form
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Step 2: customize a form
There are more options for configuring the input of forms. This page covers the various different options you have for configuring the input types in forms. Set any of these options as additional elements within the input type element.
All of the options on this page go within the <fieldset> tags:
<form>
<label>My form search</label>
<searchTemplate>put your search here $term$</searchTemplate>
<fieldset>
<input type="text" token="username" />
<!-- OPTIONS GO HERE -->
</fieldset>
...
</form>
Change the default time range
Change the default time range from all time to any of the time range strings from the time range dropdown. To change the time range, use the time inpute type and set a default attribute.
This example changes the default time range to the last 30 days:
<input type="time"> <default>Last 30 days</default> </input>
Add a label
Add a label to your form. Use this to add hints or explanation so your users know what kinds of search terms to input. To add a label, use the label attribute.
This example adds Enter a user name before the form:
<input type="text" token="username">
<label>Enter a user name</label>
</input>
Set a default search term
By default, if the user does not fill in the text box when submitting values, the token will be replaced with an empty string. You can change this behavior by setting a default value to fill in the field, or fields, of your form search. To set a default value, use the default attribute.
This example sets Juliet as the default username:
<input type="text" token="username">
<default>Juliet</default>
</input>
Add a prefix or suffix
Your search terms may require additional suffixes or prefixes. Use the prefix and suffix attributes to add additional terms to your search. These will only be added on if a user enters a search into the form.
Set a prefix on your default value:
<input type="text" token="username">
<prefix>username=</prefix>
</input>
Or quote your default value:
<input type="text" token="username">
<prefix>username="</prefix>
<suffix>"</suffix>
</input>
Pre-populate a form
You may want to pre-populate a form with known data. To pre-populate the form upon loading the page, use the seed attribute.
This example will load a form with the username Jack already in the form:
<input type="text" token="username">
<seed>Jack</seed>
</input>
Auto-run a form
You can automatically run the form when the page loads. This is a good option if you have set defaults that you want your users to see results for before searching for their own terms. Just set autoRun="true" on your <fieldset> tag. Make sure you also include a seed so the search is seeded with something, and setting a default time range is a good idea, too. Here's an example that runs the given search automatically on page load:
<fieldset autoRun="true" submitButton="false">
<input token="sourcetype">
<seed>access_combined</seed>
</input>
<input type="time">
<default>Last 30 days</default>
</input>
</fieldset>
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 View the Article History for its revisions.