Developing Dashboards, Views, and Apps for Splunk Web

 


Create a dynamic form search with radio buttons

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Create a dynamic form search with radio buttons

You can create a dynamic form search that is populated using radio buttons. You specify a search to populate radio button choices. A user selects a radio button drive the search results.

Dynamic form search example

1. Use a simple form search to get started.

<form>
 <label>Username</label>
 <searchTemplate>sourcetype=logins $username$</searchTemplate>  
 <fieldset>
  <input type="text" token="username" />
 </fieldset>
    
 <row>
  <event>
    <option name="count">100</option>
   </event>
  </row>
</form>

2. Change the input from a text box to radio buttons. Add a <populatingSearch> to generate the options for the radio buttons

. . .
<input type="radio" token="username">
   <label>Select Name</label>
   <populatingSearch fieldForValue="suser" fieldForLabel="suser">
     <![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
     | stats count by suser]]>
   </populatingSearch>
</input>
. . .

3. Display the results in a table. The following is the complete dynamic form search.

<form>
 <label>Username</label>
 <searchTemplate>sourcetype=logins $username$</searchTemplate>  

<fieldset>
   <input type="radio" token="username">
      <label>Select Name</label>
      <populatingSearch fieldForValue="suser" fieldForLabel="suser">
        <![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
        | stats count by suser]]>
      </populatingSearch>
   </input>
</fieldset>

<row>
 <table>
  <title>Users</title>
   <option name="showPager">true</option>
  </table>
</row>
</form>

Radio button configuration options

There are several configuration options available for <input type="radio">.

Tag Description
<label> String.

A label for the radio buttons

<default> The default option to select.

If the default option cannot be found, the first option is selected.

<prefix> Search terms

Prefix the search query with the specified search terms.

<suffix> Search terms

Place the specified search terms after the search query.

<choice value=value> String representing an option for the radio buttons.

Options appear in the order they are defined, and before any options generated by a search specified by <populatingSearch>.

<populatingSearch
fieldForLabel=label
fieldForValue=value>
A search that generates options for the radio buttons.

fieldForValue: Required. Field extracted from the populating search and placed in the value of the generated radio button.

fieldForLabel: Required. Field extracted from the populating search and placed as the label for the generated radio button.

<populatingSavedSearch
fieldForLabel=label
fieldForValue=value>
A saved search that generates options for the radio buttons.

fieldForValue: Required. Field extracted from the populating saved search and placed in the value of the generated radio button.

fieldForLabel: Required. Field extracted from the populating saved search and placed as the label for the generated radio button.

<earliestTime> Splunk time format.

Restrict search results to a specific time window, starting with the earliestTime. Specify "rt" to enable real-time searches.

<latestTime> Splunk time format

Restrict search results to a specific time window, ending with the latestTime. Specify "rt" to enable real-time searches.

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!