How to use populatingSavedSearch of a form field?

[sranga]

Hi

I have a <form> in which there are a few <input> elements. One of those input elements is a "dropdown" list whose values are populated using a dynamic search.

I have had success in using the populatingSearch option of the input form field. But I haven't been able to use the populatingSavedSearch. I have defined the Search to be used by the form field in the "Searches & Reports" section of the Manager application. Although the "Search" works when I access it separately, when used within the populatingSavedSearch it doesn't work. It complains that no search was defined.

This is the error I get:
SearchLister module SearchSelectLister_0_0_0 was not given a search or a saved search name to power itself and thus cannot render any data.

This is the configuration I have:
<fieldset>
<input type="dropdown" token="idname">
<label>ID</label>
<populatingSavedSearch fieldForValue="idname" fieldForLabel="idname">search_ids</populatingSavedSearch>
<choice value="*">Any</choice>
</input>
<input type="time" />
</fieldset>

Could someone provide an example of how to set up these searches? Thanks for your help.

Ranga

[sranga]

I downloaded the latest version of Splunk and this feature seems to work fine on that. Thanks for all the help.

[emma · Accepted solution]

You should be able to do this in almost exactly the same way as you'd add a populatingSavedSearch, including extracting a field for value and field for label to create the fields in the dropdown. For example:

<input type="dropdown" token="username">
  <label>Select Name</label>
  <populatingSavedSearch fieldForValue="myfield" fieldForLabel="myfield">MySearch</populatingSavedSearch>
  <choice value="*">Any</choice>
</input>

Described here:

http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Exampleform#Create_a_dynamic_form_search_using_d...

Are you having problems with this configuration? If so, please copy in your XML so we can see what exactly you're trying to do.

[sranga]

Thanks. Actually, I downloaded the latest version of Splunk and this works fine in that version. I shall check the version we have with our Splunk Admin and open up a bug accordingly

[emma]

can you copy in your XML and possibly the saved search conf? i suggest if this is really not working for you, that you contact support to file a bug. it sounds a bit buggy to me.

[sranga]

Yes, I can run the saved search on its own and "idname" is one of the fields present in the search. I tested it with a "test" view that referenced the saved search and it executed fine.

[emma]

What happens if you try to run that saved search "search_ids"? What kind of data are you getting back? is "idname" one of the fields that's present in that search?

[sranga]

Thanks for the response. I have a similar configuration, but it doesn't work for me.

API

search_ids

Any