topic text box input in Splunk Search

text box input

splunkpoornima — Tue, 20 Nov 2012 10:50:20 GMT

Hi all

in a form i need a Text box .in that whatever the value i am giving it should reterive only those task having those value as duration

i used the below code...

<form>
  <label>Sample form</label>
  <searchTemplate>
    source="C:\Users\20875\Desktop\taskmanager_log.txt"|transaction TaskBP startswith=START endswith=Succeeded|table TaskBP duration|where duration$duration$
  </searchTemplate>
  <fieldset>
      <input type="text" token="duration">
        <label>range</label>
        <default></default>
        <seed>600</seed>
      </input>
      <!-- Add default TimePicker -->
      <input type="time" />
  </fieldset>
  <row>
      <!-- Show results as a table -->
      <table>
        <option name="showPager">true</option>
        <option name="count">20</option>
      </table>
  </row>
</form>

so if i run the code, i am getting wrong output

plz suggest me the correction in the code...

Thanks in advance

poornima

Re: text box input

Drainy — Tue, 20 Nov 2012 11:11:23 GMT

| where duration==$duration$ ? or perhaps | search duration=$duration$

Re: text box input

splunkpoornima — Tue, 20 Nov 2012 11:23:42 GMT

hi drainy

thanks for ur response ...

i tried with the answer u had given ..but still i am not getting

Re: text box input

Ayn — Tue, 20 Nov 2012 11:33:12 GMT

...instead you are getting what? Hard to debug with just "it worked" or "it didn't work" as feedback. In my opinion you really need to learn debugging, so you can understand and solve issues yourself.

Re: text box input

splunkpoornima — Tue, 20 Nov 2012 11:48:50 GMT

i am getting no results found when i give the values in the text box

i used the same where codition as drainy suggested

Re: text box input

Ayn — Tue, 20 Nov 2012 11:55:02 GMT

Well did you inspect the search to see why you're not getting results?

Re: text box input

Drainy — Tue, 20 Nov 2012 11:59:46 GMT

Ayn: Check your email! Splunkppornima: Did you try the search condition instead? Also, all of what Ayn said. You really need to go and learn how to debug these problems to run Splunk effectively