Adding a drop-down list in the form

[nataliat]

Hi, I am wondering how to add a drop-down list in a dashboard/form.

The situation is the following: I have a bunch of queries that I would like to run against a specific customer. Let's say that I have: {Customer1, Customer2, Customer3,...Customer n} and the queries:
- Query 1: ... | search customerName="Customer1";
- Query 2: ... | search customerName="Customer1";
- ....
- Query m: ... | search customerName="Customer1";

I would like these queries to run against the CustomerX selected from the drop-down list {Customer1, Customer2, Customer3,...Customer n}

Is possible to get this done using Splunk? Any help will be more than welcome.

I'm using Splunk 6.0

Many thanks.

[nataliat]

I managed to get a solution for my own question 🙂

The code that is required is the following using Simple XML:

<form>

 <fieldset>

  <input type="dropdown" token="customer">

   <default>Alaska </default>

   <label>Select a Customer name: </label>

   <populatingSearch fieldForValue="customerName" fieldForLabel="customerName">

    <![CDATA[eventtype=xxx | stats count by customerName]]>

   </populatingSearch>

  </input>

 </fieldset>

 <row>

  <table>

   <title>Function Usage </title>

   <searchString>eventtype=xxx| search customerName="$customer$" | yyy </searchString>

   <option name="wrap">true </option>

   <option name="rowNumbers">false </option>

   <option name="dataOverlayMode">none </option>

   <option name="drilldown">row </option>

   <option name="count">10 </option>

  </table>

  </row>

</form>

Notes:

1. fieldForValue and fieldforLabel match with the field extracted from the populating search, in this case customerName,
2. The searchString is using $customer$ as value for customerName as customer is the variable name used for token in the dropdown.