Developing Dashboards, Views, and Apps for Splunk Web

 


Define inputs to a form

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Define inputs to a form

The <fieldset> tag defines form inputs. This section describes how to modify elements within the <fieldset> tag to customize inputs.

<form>
  <label>Sample form search</label>
  <searchTemplate>index=sample from="$from$"</searchTemplate>

  <!-- Define Inputs here -->
  <fieldset> 
      <input type="text" token="from" />
  </fieldset>

  <row>
      <event>
            <title>Results</title>
            <option name="count">50</option>
      </event>
  </row>
</form>

Specify a TimePicker with a default time range

If you do not specify a time range, the time range defaults to all time. You can add a TimePicker (a time range dropdown) with a default time setting. Set the default time range to any of the strings availalble from the time range dropdown.

This example adds a time picker and sets the default time range to the last 30 days:

. . .
<!-- TimePicker with customized default time range -->
<input type="time">
  <default>Last 30 days</default>
</input>
. . .

Add a label

Use the <label> tag to add a descriptive label to the input. This example adds Enter a user name before a text input:

. . .
<input type="text" token="username">
    <label>Enter a user name</label>
</input>
. . .

Set a default search term

If the user does not fill in the text box when submitting values, the token defaults to an empty string. To set a default value for the token in a search, use the <default> tag.

This example sets Cosmo as the default value for the token specifying a username:

. . .
<input type="text" token="username">
    <default>Cosmo</default>
</input>
. . .

Add a prefix or suffix

A search query often requires additional suffixes or prefixes. Use the <prefix> and <suffix> tags to add additional terms to a search query. The <prefix> and <suffix> tags are only used when a user enters a search in the text box.

Set a prefix on the default value:

. . .
<input type="text" token="username">
    <prefix>username=</prefix>
</input>
. . .

Quote the default value:

. . .
<input type="text" token="username">
    <prefix>username="</prefix>
    <suffix>"</suffix>
</input>
. . .

Populate a form with data

Use the <seed> tag to populate a form with known data.

This example populates a form with the username Jack:

. . .
<input type="text" token="username">
    <seed>Jack</seed>
</input>
. . .

Auto-run a form

You can automatically run a form when the page loads. Use the auto-run feature if you have set defaults from which you want your users to see results before specifying their own search.

Specify the following attributes to the <fieldset> tag.

autoRun="true"
submitButton="false"

Make sure you also include a seed for the search. Setting a default time range is a good idea.

Here's an example that runs the specified search on page load:

. . .
  <fieldset autoRun="true" submitButton="false">
    <input token="sourcetype">
      <seed>access_combined</seed>
    </input>
    <input type="time">
      <default>Last 30 days</default>
    </input>
  </fieldset>
. . .

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 4.3.7 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!