SavedSearch containing $field_name$

Ant1D — Tue, 26 Oct 2010 23:47:54 GMT

Hey,

I have written the following code for a form:

  <form>

         <label>Combo box test</label>

        <!-- <searchName>Test SavedSearch</searchName> -->
        <searchTemplate>index="general_logs" name=$name$ | fields name type source</searchTemplate> 

        <fieldset submitButton="false">
            <input type="dropdown" token="name" searchWhenChanged="true">
            <label>Name</label>
            <populatingSavedSearch fieldForValue="name" fieldForLabel="name">names_list</populatingSavedSearch>
            <choice value="*">Any</choice>
            </input>
            </fieldset>


            <row>
               <table>
                  <title>Test Data</title>
                  <option name="count">50</option>
                  <option name="showPager">true</option>
               </table>
            </row>

  </form>

At present, each time a name is selected from the dropdown list, the name selected is used to automatically run the search inside the searchTemplate tags.

I tried to use a scheduled saved search (which is identical to the search in the searchTemplate tags) to achieve the same results (see commented out searchName tags in code above) but it does not produce the same results when I choose a name from my dropdown list. I don't think that the field $name$ in my saved search is being populated with the data selected in my dropdown list. How can I get this to work?

Thanks in advance for your help.

Re: SavedSearch containing $field_name$

Ledion_Bitincka — Fri, 29 Oct 2010 09:11:13 GMT

Saved searches cannot be used to create form searches. Well, you can but you still need to use searchTemplate as follows:

 <searchTemplate>| savedsearch "<savedsearch-name>" name=$name$ </searchTemplate>

So basically, the UI right now can only replace form inputs in a searchTemplate

For more info on how to use the savedsearch command look at the manual: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Savedsearch

topic Re: SavedSearch containing $field_name$ in Splunk Search

SavedSearch containing $field_name$

Re: SavedSearch containing $field_name$