topic Passing variable to populatingSearch in Splunk Search

Passing variable to populatingSearch

anujojha — Thu, 08 May 2014 22:49:55 GMT

This is what I am trying to do:
I have a time range drop down which will provide value to a dynamic populated drop down. I have tried the following but it fail saying "Invalid value "$earliest$" for time term 'earliest'"

{code}

2 days
3 days

<input type="dropdown" token="id">
  <label>ID</label>
  <populatingSearch fieldForValue="ID" fieldForLabel="ID">
  <![CDATA[search index=login sourcetype=login_logs earliest="$earliest$" | dedup 1 ID]]>
  </populatingSearch>
</input>

{code}

If I provide a string value as earliest="-2d@d" it works. But I want the drop down to populate the value in search string. Is it possible to earliest as:
as argument?

Re: Passing variable to populatingSearch

lguinn2 — Thu, 08 May 2014 23:06:31 GMT

I think you are close, what if you do this

<input type="dropdown" searchwhenchanged="true" token="earliest">
      <choice value="-2d@d">2 days</choice>
      <choice value="-3d@d">3 days</choice>
    </input>

<input type="dropdown" token="id">
  <label>ID</label>
  <populatingSearch fieldForValue="ID" fieldForLabel="ID">
      <![CDATA[search index=login sourcetype=login_logs| dedup 1 ID]]>
      <earliestTime>$earliest$</earliestTime>
  </populatingSearch>
</input>

Notice that I moved the $earliest$ token from within the populating search and into a separate tag.

Re: Passing variable to populatingSearch

anujojha — Fri, 09 May 2014 00:15:35 GMT

If I use tag then it does not uses the days provided from drop down it take default days.

Re: Passing variable to populatingSearch

anujojha — Fri, 09 May 2014 00:15:53 GMT

If I use tag then it does not uses the days provided from drop down it take default days.