topic Pass form field values to saved searches in Reporting

Pass form field values to saved searches

sranga — Tue, 20 Apr 2010 01:25:12 GMT

I have a dynamic form that displays a chart. I was wondering if the following is possible:

1) Execute a "Saved Search" to populate the values for one of the form field's (dropdown) list. I tried using populatingSavedSearch and it does not work [see example below]
2) Execute the search for populating the chart in a schedule. I can do this for static searches. Since I have a need to pass in form field values to the search, this needs to work for dynamic searches. Can I replace the searchTemplate [see example below] with a searchName? If not, is there another way to specify running the search on a schedule?

Example configuration (does not work😞

<form>  
  <label>Saved Search</label>  
  <fieldset>  
    <input type="dropdown" token="id">
      <label>ID</label>
      <prefix>id="</prefix>
      <suffix>"</suffix>
      <populatingSavedSearch fieldForValue="idname" fieldForLabel="idname">saved_values
      </populatingSavedSearch>  
    </input>
    <input type="time" />
  </fieldset>
  <row>
    <chart>
      <searchTemplate>`summary` | search $id$</searchTemplate>
      <title>My Dynamic Saved Search</title>
    </chart>
  </row>  
</form>

saved_values:

index="list_app" | top limit=0 idname | fields + idname | sort idname

summary:

index="my_app" source="test*"

Thanks for your help.

Ranga

Re: Pass form field values to saved searches

gkanapathy — Tue, 20 Apr 2010 07:37:16 GMT

you need to show us the definition of the saved_values saved search, as well as probably some of the data or output of the search. incidentally, and this isn't fundamental to your UI issue, your searchTemplate should be source="test*" AND $id$, not using the search operator unnecessarily.

Re: Pass form field values to saved searches

gkanapathy — Tue, 20 Apr 2010 07:39:46 GMT

Also, I don't understand what you mean when you say you want to run a search on a schedule, but also allow a user to dynamically populate in one of the (required, I would think) parameters of the search.

Re: Pass form field values to saved searches

sranga — Tue, 20 Apr 2010 22:54:57 GMT

I've added the saved_values and summary search/search macros to the original question (above). As for the scheduled search, I was wondering if a dynamic search could be scheduled to run the search for all of the values in the input list periodically.

Re: Pass form field values to saved searches

thall79 — Wed, 21 Apr 2010 01:24:21 GMT

Ok if I am reading this correctly are you wanting a savedsearch to populate a drop down box. Then from that drop down box you want to make a selection to generate a chart.

Have you tried using a SearchSelectLister:

http://www.splunk.com/base/Documentation/4.1.1/Developer/ModuleReference#SearchSelectLister

http://www.splunk.com/base/Documentation/4.1.1/Developer/HowToUseListers#SearchSelectLister

Then you could set the dashboard to refresh every X amount seconds and it will generate new data.

Travis.

Re: Pass form field values to saved searches

sranga — Wed, 21 Apr 2010 03:16:09 GMT

Thanks. Yes, the problem statement you described is what I want. I shall look into the SearchSelectLister module. Would this result in the "default" value search being run every so often or would it actually run the search for all of the values in the list every X amount of time?

Re: Pass form field values to saved searches

thall79 — Wed, 21 Apr 2010 04:18:27 GMT

Everything on the Dashboard would be refreshed at X time. In my main dashboard I begin my XML like this to refresh everything every 10 minutes:

Here is example of SearchSelectLister that I used for awhile, but rebuilt it using field searches and a LinkSwitcher which works better for my views.

http://www.splunk.com/support/forum:SplunkDev/3806

Travis.