Dashboards & Visualizations

Can't sort table results from a form search

jambajuice
Communicator

I have a form search that looks like the following:

<row>
    <table>
        <title>JAMBAJUICE</title>
        <searchTemplate>EventCode=644 OR EventCode=4740 Caller_Domain="DOMAIN" NOT (term OR Term) | stats count by user</searchTemplate>
            <option name="showPager">true</option>
                <option name="count">20</option>        
    </table>
</row>

When I get the results back, I don't see the fields available to sort the results. How do I get those to display on the table?

Thanks.

Tags (1)
0 Karma

Genti
Splunk Employee
Splunk Employee

What fields are showing up by default and What fields are you looking for?
Try adding this right underneath your searchTemplate:

<fields>My-first-field, my-second-field, etc</fields>

So your xml should be:

<row>
    <table>
        <title>JAMBAJUICE</title>
        <searchTemplate>EventCode=644 OR EventCode=4740 Caller_Domain="DOMAIN" NOT (term OR Term) | stats count by user</searchTemplate>
        <fields>My-first-field, my-second-field, etc</fields>
            <option name="showPager">true</option>
            <option name="count">20</option>        
    </table>
</row>
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...