Create a dynamic form search using drop-downs
Create a dynamic form search using drop-downs
You can create a dynamic form search that is populated using a dropdown list. You specify a search to populate the choice in the list. A user selects from the list to drive the search results.
Dynamic form search example
1. Use a simple form search to get started.
<form>
<label>Username</label>
<searchTemplate>sourcetype=logins $username$</searchTemplate>
<fieldset>
<input type="text" token="username" />
</fieldset>
<row>
<event>
<option name="count">100</option>
</event>
</row>
</form>
2. Change the input from a text box to dropdown list. Add a <populatingSearch> to generate the options for the list.
. . .
<input type="dropdown" token="username">
<label>Select Name</label>
<populatingSearch fieldForValue="suser" fieldForLabel="suser">
<![CDATA[sourcetype=p4change
| rex "user=(?<suser>\w+)@"
| stats count by suser]]>
</populatingSearch>
</input>
. . .
3. Display the results in a table. The following is the complete dynamic form search.
<form>
<label>Username</label>
<searchTemplate>sourcetype=logins $username$</searchTemplate>
<fieldset>
<input type="text" token="username" />
</fieldset>
<input type="dropdown" token="username">
<label>Select Name</label>
<populatingSearch fieldForValue="suser" fieldForLabel="suser">
<![CDATA[sourcetype=p4change
| rex "user=(?<suser>\w+)@"
| stats count by suser]]>
</populatingSearch>
</input>
<row>
<table>
<title>Users</title>
<option name="showPager">true</option>
</table>
</row>
</form>
Dropdown list configuration options
There are several configuration options available for <input type="dropdown">.
| Tag | Description |
|---|---|
<label>label</label> | A label for the dropdown list.. |
<default>option</default> | The default option to select. If the default option cannot be found, the first option is selected. |
<prefix>search terms</prefix> | Prefix the search query with the specified search terms. |
<suffix>search terms</suffix> | Place the specified search terms after the search query. |
<choice value="value"> | Specify options for the dropdown list. Options appear in the order they are defined, and before any options generated by a search specified by <populatingSearch>.
|
<populatingSearch fieldForLabel="label" fieldForValue="value"> | A search that generates options for the dropdown list. Requires the attributes fieldForValue and fieldForLabel. fieldForValue is the field extracted from the populatingSearch and placed in the value of the generated list option. fieldForLabel is the field extracted from the populatingSearch and placed as the label for the list option.
|
<populatingSavedSearch fieldForLabel="label" fieldForValue="value"> | A saved search that generates options for the dropdown list. Requires the attributes fieldForValue and fieldForLabel. fieldForValue is the field extracted from the populatingSavedSearch and placed in the value of the generated list option. fieldForLabel is the field extracted from the populatingSavedSearch and placed as the label for the list option.
|
<earliestTime>Splunk time format</earliestTime> | Restrict your search results to a specific time window, starting with the earliestTime. Specify "rt" to enable real-time searches. |
<latestTime>Splunk time format</latestTime> | Restrict your search results to a specific time window, ending with the latestTime. Specify "rt" to enable real-time searches. |
This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.