Splunk® Enterprise

Knowledge Manager Manual

Download manual as PDF

Splunk Enterprise version 5.0 reached its End of Life on December 1, 2017. Please see the migration information.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Design form searches

Form searches are simplified search interfaces that help guide users in the creation of specific kinds of searches. They can include things like:

  • Open fields that take specific field values (such as user names or ID numbers) and can also display default values.
  • Dropdown lists containing dynamically defined collections of search terms.
  • Radio buttons that force the choice of particular field values (such as error codes like "404," "500," or "503").
  • Multiple result panels that take the values received from one form and plug them into various hidden searches that in turn generate different kinds of charts and reports.

Form searches are created with XML code similar to that used for the construction of dashboards in Splunk. For more information, see the "Build and edit forms with simple XML" chapter of the Splunk Data Visualizations manual.

Design macro searches
Define navigation to saved searches and reports

This documentation applies to the following versions of Splunk® Enterprise: 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.0.10, 5.0.11, 5.0.12, 5.0.13, 5.0.14, 5.0.15, 5.0.16, 5.0.17, 5.0.18

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters