Define inputs to a form
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
Define inputs to a form
The <fieldset> tag defines form inputs. This section describes how to modify elements within the <fieldset> tag to customize inputs.
<form>
<label>Sample form search</label>
<searchTemplate>index=sample from="$from$"</searchTemplate>
<!-- Define Inputs here -->
<fieldset>
<input type="text" token="from" />
</fieldset>
<row>
<event>
<title>Results</title>
<option name="count">50</option>
</event>
</row>
</form>
Specify a TimePicker with a default time range
If you do not specify a time range, the time range defaults to all time. You can add a TimePicker (a time range dropdown) with a default time setting. Set the default time range to any of the strings availalble from the time range dropdown.
This example adds a time picker and sets the default time range to the last 30 days:
. . . <!-- TimePicker with customized default time range --> <input type="time"> <default>Last 30 days</default> </input> . . .
Add a label
Use the <label> tag to add a descriptive label to the input.
This example adds Enter a user name before a text input:
. . .
<input type="text" token="username">
<label>Enter a user name</label>
</input>
. . .
Set a default search term
If the user does not fill in the text box when submitting values, the token defaults to an empty string. To set a default value for the token in a search, use the <default> tag.
This example sets Cosmo as the default value for the token specifying a username:
. . .
<input type="text" token="username">
<default>Cosmo</default>
</input>
. . .
Add a prefix or suffix
A search query often requires additional suffixes or prefixes. Use the <prefix> and <suffix> tags to add additional terms to a search query. The <prefix> and <suffix> tags are only used when a user enters a search in the text box.
Set a prefix on the default value:
. . .
<input type="text" token="username">
<prefix>username=</prefix>
</input>
. . .
Quote the default value:
. . .
<input type="text" token="username">
<prefix>username="</prefix>
<suffix>"</suffix>
</input>
. . .
Populate a form with data
Use the <seed> tag to populate a form with known data.
This example populates a form with the username Jack:
. . .
<input type="text" token="username">
<seed>Jack</seed>
</input>
. . .
Auto-run a form
You can automatically run a form when the page loads. Use the auto-run feature if you have set defaults from which you want your users to see results before specifying their own search.
Specify the following attributes to the <fieldset> tag.
-
autoRun="true" -
submitButton="false"
Make sure you also include a seed for the search. Setting a default time range is a good idea.
Here's an example that runs the specified search on page load:
. . .
<fieldset autoRun="true" submitButton="false">
<input token="sourcetype">
<seed>access_combined</seed>
</input>
<input type="time">
<default>Last 30 days</default>
</input>
</fieldset>
. . .
This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.