Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Create a dynamic form search using drop-downs

You can create a dynamic form search that is populated using a dropdown list. You specify a search to populate the choice in the list. A user selects from the list to drive the search results.

Dynamic form search example

1. Use a simple form search to get started.

<form>
 <label>Username</label>
 <searchTemplate>sourcetype=logins $username$</searchTemplate>  
 <fieldset>
  <input type="text" token="username" />
 </fieldset>
    
 <row>
  <event>
    <option name="count">100</option>
   </event>
  </row>
</form>

2. Change the input from a text box to dropdown list. Add a <populatingSearch> to generate the options for the list.

. . .
<input type="dropdown" token="username">
   <label>Select Name</label>
   <populatingSearch fieldForValue="suser" fieldForLabel="suser">
      <![CDATA[sourcetype=p4change 
      | rex "user=(?<suser>\w+)@"
      | stats count by suser]]>
    </populatingSearch>
</input>
. . .

3. Display the results in a table. The following is the complete dynamic form search.

<form>
  <label>Username</label>
  <searchTemplate>sourcetype=logins $username$</searchTemplate>  
  <fieldset>
    <input type="dropdown" token="username">
       <label>Select Name</label>
       <populatingSearch fieldForValue="suser" fieldForLabel="suser">
          <![CDATA[sourcetype=p4change 
          | rex "user=(?<suser>\w+)@"
          | stats count by suser]]>
        </populatingSearch>
    </input>
  </fieldset>

  <row>
    <table>
      <title>Users</title>
        <option name="showPager">true</option>
      </table>
  </row>
</form>

Dropdown list configuration

There are several configurations available for <input type="dropdown">.

Tag Description
<label> String.

A label for the dropdown list.

<default> The default option to select.

If the default option cannot be found, the first option is selected.

<prefix> Search terms

Prefix the search query with the specified search terms.

<suffix> Search terms

Place the specified search terms after the search query.

<choice value=value> String representing an option for the dropdown list.

Options appear in the order they are defined, and before any options generated by a search specified by <populatingSearch>.

<populatingSearch
fieldForLabel=label
fieldForValue=value>
A search that generates options for the dropdown list.

fieldForValue: Required. Field extracted from the populating search and placed in the value of the generated list option.

fieldForLabel: Required. Field extracted from the populating search and placed as the label for the list option.

<populatingSavedSearch
fieldForLabel=label
fieldForValue=value>
A saved search that generates options for the dropdown list.

fieldForValue: Required. Field extracted from the populating saved search and placed in the value of the generated list option.

fieldForLabel: Required. Field extracted from the populating saved search and placed as the label for the list option.

<earliestTime> Splunk time format.

Restrict search results to a specific time window, starting with the earliestTime. Specify "rt" to enable real-time searches.

<latestTime> Splunk time format

Restrict search results to a specific time window, ending with the latestTime. Specify "rt" to enable real-time searches.

PREVIOUS
Create a dynamic form search with radio buttons
  NEXT
Drive multiple panels in a form

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Comments

I fixed the cut 'n paste error in the Step 3 code sample for specifying inputs to the form. I also reformatted the tables describing list configuration to make it easier to read. Thanks to Jnlulejian and MHibbin for their comments!

Vgenovese, Splunker
October 23, 2012

MHibbin, you are correct. This resulted in much difficulty for me when I attempted to run it. <br /><br />The correct XML would look like this: (With the inside of the fieldset, and there being only one, not two as in the example)<br /><br /><br /> Username<br /> sourcetype=logins $username$ <br /><br /> <br /><br /> Select Name<br /> <br /> <br /> <br /><br /><br /><br /><br /> <br /> Users<br /> true<br /> <br /><br />

Jnlulejian
October 19, 2012

I believe there is an error in part 3...<br /><br />There are inputs (for the dropdown) outside of the field set.<br /><br />Regards,<br /><br />MHibbin

MHibbin
June 25, 2012

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters