Splunk® Enterprise

Developing Dashboards, Views, and Apps for Splunk Web

Download manual as PDF

Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Display form search results

To display results of a form search, add a row to the form much the same way you add rows to a dashboard. Then select a visualization for the results. You can use some of the same visualizations available for panels in dashboards. This section illustrates using an event listing, a table, and charts.

Display results in an event listing

To display results as a list of events, add a <row> element with an <event> node to your form search. The event listing displays the search results as individual events.

The following example displays the last 100 login events over the past seven days for the username entered in the form:

<form>
    <label>Username</label>
    
    <searchTemplate>sourcetype=logins $username$</searchTemplate>
    <earliestTime>-7d</earliestTime>
    <latestTime>-0d</latestTime>    

    <fieldset>
        <input type="text" token="username" />
    </fieldset>
    
    <row>
        <event>
            <option name="count">100</option>
        </event>
    </row>
</form>

To learn more about event listing, see "Add an event listing" in the Build dashboards section of this manual. Also, refer to the "Event panel" section of the Simplified XML Panel Reference.

Display results in a table

To display results in a table, add a <row> element with a <table> node to your form search.

The following example displays results returned by the form search in table. The table contains a pager, specifying 20 rows per page.

<form>
    <label>Username</label>
    
    <searchTemplate>sourcetype=logins $username$ </searchTemplate>
    <earliestTime>-7d</earliestTime>
    <latestTime>-0d</latestTime>
    
    <fieldset>
        <input type="text" token="username" />
    </fieldset>
    
    <row>
      <table>
        <title>User logins</title>
        <option name="showPager">true</option>
        <option name="count">20</option>
      </table>
    </row>
</form>

To learn more about displaying results in a table, see "Add a table" in the Build dashboards section of this manual. Also, refer to the "Table panel" section of the Simplified XML Panel Reference.

Display results in a chart

To display results in a chart, add a <row> element with a <chart> node to your form search. Use the chart's <option> tags to specify the type of chart and any chart properties. Chart types include bar, column, area, line, pie, scatter, and bubble. Charts require transforming searches (searches that use reporting commands) whose results involve one or more series. For more information on the chart visualizations available, see "Charts" in the Splunk User Manual.

The following example creates a form search displaying results in a column chart The search has includes reporting commands (timechart count).

<form>
    <label>Username</label>
    
    <searchTemplate>sourcetype=logins $username$ | timechart count</searchTemplate>
    <earliestTime>-7d</earliestTime>
    <latestTime>-0d</latestTime>
    
    <fieldset>
        <input type="text" token="username" />
    </fieldset>
    
    <row>
      <chart>
        <title>User logins, last 7 days</title>
        <option name="charting.chart">column</option>
        <option name="charting.primaryAxisTitle.text">User</option>
        <option name="charting.secondaryAxisTitle.text">Total logins</option>
        <option name="charting.legend.placement">none</option>
      </chart>
    </row>
</form>

In this example, Splunk's chart formatting controls specify the axis titles and removes the chart legend (you really don't need a legend when only one series is displayed). The primaryAxisTitle and secondaryAxisTitle elements are similar to the axisTitleX and axisTitleY elements described in the charting controls documentation. For more information see the Custom chart configuration reference chapter in this manual.

To learn more about charts, see "Add a chart" in the Build dashboards section of this manual.

PREVIOUS
Define inputs to a form
  NEXT
Create a dynamic form search with radio buttons

This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters