topic Re: Issue with simple XML dropdown search in Dashboards & Visualizations

Issue with simple XML dropdown search

MHibbin — Tue, 20 Dec 2011 10:56:35 GMT

SplunkBase,

I have a query about dropdown searches using the simple XML editor in Splunk. I fear I am missing something blindingly obvious, but I just can't seem to see it.

I started by creating a view which includes a search (text input) for a user and displays a table of results, which works. However when I change the input to dropdown, and add the populating search. I receive the following error...

SearchLister module SearchSelectLister_0_1_0 was not given a search or a saved search name to power itself and thus cannot render any data.

Below is the XML I have edited...

<form>
  <label>User Search (DropDown Selecter)</label>
  <searchTemplate>sourcetype=logs user=$username$ | table _time user message</searchTemplate>

  <fieldset>
    <input type="dropdown" token="username" />
      <label>Select user name</label>
      <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
      <default>*</default>
  </fieldset>

  <row>
    <table>
      <title>User message activity (Last 100)</title>
        <option name="showPager">true</option>
        <option name="count">100</option>
    </table>
  </row>

</form>

Any assistance would be appreciated and many thanks in advance.

Regards,

MHibbin

Re: Issue with simple XML dropdown search

Ayn — Tue, 20 Dec 2011 11:47:52 GMT

You're closing the dropdown <input> tag immediately but you should be keeping it open and run your populatingSearch inside the input section. So:

<input type="dropdown" token="username">
  <label>Select user name</label>
  <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
  <default>*</default>
</input>

Re: Issue with simple XML dropdown search

MHibbin — Tue, 20 Dec 2011 11:49:45 GMT

Thanks Ayn, I knew it would be blindingly obvious... I was determined in thinking it was the search string, so didn't look else where!

Re: Issue with simple XML dropdown search

monicato — Wed, 18 Jul 2012 16:22:29 GMT

On a different note, @MHibbin, is your populating search taking an incredibly long time to load for the dropdown? I have a problem where my populating search takes 30min+ to complete. The only solution I could think of was listing static options for my dropdown... any ideas to speed the populating search up? ~thanks!

Re: Issue with simple XML dropdown search

MHibbin — Wed, 18 Jul 2012 20:54:33 GMT

@monicato, No I never had those issues, what is the search you are using? ... how long does it take running in flashtimeline?

Re: Issue with simple XML dropdown search

monicato — Wed, 18 Jul 2012 21:03:41 GMT

@MHibbin, I'm not quite sure, but my populating search is basically searching through millions of logs to find the name of different products. And the complete search returns about 150 different product names. Is there any way to have a saved search and then i could extract the saved search for all the products names instead of having to go through all the logs each time my view is loaded?

Re: Issue with simple XML dropdown search

Ayn — Wed, 18 Jul 2012 21:22:05 GMT

That is possible. It might be better to discuss that in the thread you created yourself though... 🙂