Display form search results

Display form search results

To display results of a form search, add a row to the form much the same way you add rows to a dashboard. Then select a visualization for the results. You can use some of the same visualizations available for panels in dashboards. This section illustrates using an event listing, a table, and charts.

Display results in an event listing

To display results as a list of events, add a <row> element with an <event> node to your form search. The event listing displays the search results as individual events.

The following example displays the last 100 login events over the past seven days for the username entered in the form:

<form>
    <label>Username</label>
    
    <searchTemplate>sourcetype=logins $username$</searchTemplate>
    <earliestTime>-7d</earliestTime>
    <latestTime>-0d</latestTime>    

    <fieldset>
        <input type="text" token="username" />
    </fieldset>
    
    <row>
        <event>
            <option name="count">100</option>
        </event>
    </row>
</form>

To learn more about event listing, see "Add an event listing" in the Build dashboards section of this manual. Also, refer to the "Event panel" section of the Simplified XML Panel Reference.

Display results in a table

To display results in a table, add a <row> element with a <table> node to your form search.

The following example displays results returned by the form search in table. The table contains a pager, specifying 20 rows per page.

<form>
    <label>Username</label>
    
    <searchTemplate>sourcetype=logins $username$ </searchTemplate>
    <earliestTime>-7d</earliestTime>
    <latestTime>-0d</latestTime>
    
    <fieldset>
        <input type="text" token="username" />
    </fieldset>
    
    <row>
      <table>
        <title>User logins</title>
        <option name="showPager">true</option>
        <option name="count">20</option>
      </table>
    </row>
</form>

To learn more about displaying results in a table, see "Add a table" in the Build dashboards section of this manual. Also, refer to the "Table panel" section of the Simplified XML Panel Reference.

Display results in a chart

To display results in a chart, add a <row> element with a <chart> node to your form search. Use the chart's <option> tags to specify the type of chart and any chart properties. Chart types include bar, column, area, line, pie, scatter, and bubble. Charts require transforming searches (searches that use reporting commands) whose results involve one or more series. For more information on the chart visualizations available, see "Charts" in the Splunk User Manual.

The following example creates a form search displaying results in a column chart The search has includes reporting commands (timechart count).

<form>
    <label>Username</label>
    
    <searchTemplate>sourcetype=logins $username$ | timechart count</searchTemplate>
    <earliestTime>-7d</earliestTime>
    <latestTime>-0d</latestTime>
    
    <fieldset>
        <input type="text" token="username" />
    </fieldset>
    
    <row>
      <chart>
        <title>User logins, last 7 days</title>
        <option name="charting.chart">column</option>
        <option name="charting.primaryAxisTitle.text">User</option>
        <option name="charting.secondaryAxisTitle.text">Total logins</option>
        <option name="charting.legend.placement">none</option>
      </chart>
    </row>
</form>

In this example, Splunk's chart formatting controls specify the axis titles and removes the chart legend (you really don't need a legend when only one series is displayed). The primaryAxisTitle and secondaryAxisTitle elements are similar to the axisTitleX and axisTitleY elements described in the charting controls documentation. For more information see the Custom chart configuration reference chapter in this manual.

To learn more about charts, see "Add a chart" in the Build dashboards section of this manual.

• Was this topic useful?
• Post a comment