topic passing variables within a form in Dashboards & Visualizations

passing variables within a form

DTERM — Tue, 20 Mar 2012 15:58:39 GMT

I've trying to pass variables within a form. It does not appear to be working. The code below produces the dropdown. The dropdown works. I need to pass the variable from the dropdown to the rest of the form to produce the charts. Any idea why the variable is not passed or why the charts are not displayed?

Thanks.

<form class="formsearch">

ZHost

index=MyApp host=host

Select ZHost All |inputlookup zhost.csv | fields + zhost Last 7 days

Top Hosts

index=myapp host=$zhost$ | top serviceName limit="10"
pie
all

Top Hosts
index=myapp host=$zhost$ | top productName limit="10"
bar
all

Re: passing variables within a form

cphair — Tue, 20 Mar 2012 17:00:37 GMT

Hi dterm,

Capitalization matters in Splunk tags. Use populatingSearch, searchTemplate, fieldForValue, and fieldForLabel.
I don't think you need the searchTemplate entry anyway; my search works without it.
Pass $host$ instead of $zhost$ to your search.
I changed the tag search to searchString in your chart section and got a chart to display for my sample data.

Let me know if this helps.

Re: passing variables within a form

DTERM — Thu, 22 Mar 2012 18:11:52 GMT

Worked great!! thanks so much!!