topic Re: Populate dropdown from searchTemplate in Dashboards & Visualizations

Populate dropdown from searchTemplate

Simon — Wed, 19 Feb 2014 11:44:11 GMT

Hi all,

in Splunk 6 SimpleXML dashboards, there is support for a global search template (<searchTemplate />) and postprocessing (<searchPostProcess />) in panels later.
Is it somehow possible to postprocess the searchtemplate to populate a dropdown input?

Thanks,
Simon

Re: Populate dropdown from searchTemplate

gfreitas — Wed, 19 Feb 2014 12:57:04 GMT

Hi Simon,

I have some dashboards that populate a dropdown, it's like this:

<fieldset> <input type="dropdown" token="dropdownlabel"> <label>Select:</label> <populatingSearch fieldForValue="dropdownlabel" fieldForLabel="dropdownlabel"> <![CDATA[sourcetype="src" earliest=-7d | stats count by dropdownlabel]]> </populatingSearch> </input> <input type="time"> <default>Last 7 days</default> </input> </fieldset>

You just needs to wait some seconds until the search return the list of dropdown and then select the content.
Hope this helps!

Re: Populate dropdown from searchTemplate

Simon — Wed, 19 Feb 2014 13:03:07 GMT

Hello,
Thanks I was aware of this option!
I rather was searching for a solution to only have one running search,e.g.

<form>
  <searchTemplate>index=_internal</searchTemplate>
  <fieldset>
    <input type="dropdown" token="sourcetype=" fieldForValue="sourcetype" fieldForLabel="label">
     <searchPostProcess>stats count by sourcetype | eval label=sourcetype." (".count.")"</searchPostProcess>
     <choice value="*">All</choice>
     <default>*</choice>
    </input>
  </fieldset>
</form>

Re: Populate dropdown from searchTemplate

Simon — Wed, 19 Feb 2014 13:03:27 GMT

And later of course

Hello,
Thanks I was aware of this option!
I rather was searching for a solution to only have one running search,e.g.

<row>
    <chart>
      <searchPostProcess>search sourcetype="$sourcetype$"|  timechart count by sourcetype
      ...
    </chart>
</row>

Re: Populate dropdown from searchTemplate

somesoni2 — Wed, 19 Feb 2014 16:13:16 GMT

I believe works only for row elements.

Re: Populate dropdown from searchTemplate

cramasta — Mon, 05 May 2014 18:54:02 GMT

Anyone from Splunk able to comment on this? I would also like to postprocess the search template to populate my values in the dropdown menu.

Re: Populate dropdown from searchTemplate

helenashton — Thu, 08 Jan 2015 22:44:17 GMT

did you ever find an answer to this?