Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Create a dynamic form search with radio buttons

You can create a dynamic form search that is populated using radio buttons. You specify a search to populate radio button choices. A user selects a radio button drive the search results.

Dynamic form search example

1. Use a simple form search to get started.

<form>
 <label>Username</label>
 <searchTemplate>sourcetype=logins $username$</searchTemplate>  
 <fieldset>
  <input type="text" token="username" />
 </fieldset>
    
 <row>
  <event>
    <option name="count">100</option>
   </event>
  </row>
</form>

2. Change the input from a text box to radio buttons. Add a <populatingSearch> to generate the options for the radio buttons

. . .
<input type="radio" token="username">
   <label>Select Name</label>
   <populatingSearch fieldForValue="suser" fieldForLabel="suser">
     <![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
     | stats count by suser]]>
   </populatingSearch>
</input>
. . .

3. Display the results in a table. The following is the complete dynamic form search.

<form>
 <label>Username</label>
 <searchTemplate>sourcetype=logins $username$</searchTemplate>  

<fieldset>
   <input type="radio" token="username">
      <label>Select Name</label>
      <populatingSearch fieldForValue="suser" fieldForLabel="suser">
        <![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
        | stats count by suser]]>
      </populatingSearch>
   </input>
</fieldset>

<row>
 <table>
  <title>Users</title>
   <option name="showPager">true</option>
  </table>
</row>
</form>

Radio button configuration options

There are several configuration options available for <input type="radio">.

Tag Description
<label> String.

A label for the radio buttons

<default> The default option to select.

If the default option cannot be found, the first option is selected.

<prefix> Search terms

Prefix the search query with the specified search terms.

<suffix> Search terms

Place the specified search terms after the search query.

<choice value=value> String representing an option for the radio buttons.

Options appear in the order they are defined, and before any options generated by a search specified by <populatingSearch>.

<populatingSearch
fieldForLabel=label
fieldForValue=value>
A search that generates options for the radio buttons.

fieldForValue: Required. Field extracted from the populating search and placed in the value of the generated radio button.

fieldForLabel: Required. Field extracted from the populating search and placed as the label for the generated radio button.

<populatingSavedSearch
fieldForLabel=label
fieldForValue=value>
A saved search that generates options for the radio buttons.

fieldForValue: Required. Field extracted from the populating saved search and placed in the value of the generated radio button.

fieldForLabel: Required. Field extracted from the populating saved search and placed as the label for the generated radio button.

<earliestTime> Splunk time format.

Restrict search results to a specific time window, starting with the earliestTime. Specify "rt" to enable real-time searches.

<latestTime> Splunk time format

Restrict search results to a specific time window, ending with the latestTime. Specify "rt" to enable real-time searches.

PREVIOUS
Display form search results
  NEXT
Create a dynamic form search using drop-downs

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters