Dashboards & Visualizations

How to use populatingSavedSearch of a form field?

sranga
Path Finder

Hi

I have a <form> in which there are a few <input> elements. One of those input elements is a "dropdown" list whose values are populated using a dynamic search.

I have had success in using the populatingSearch option of the input form field. But I haven't been able to use the populatingSavedSearch. I have defined the Search to be used by the form field in the "Searches & Reports" section of the Manager application. Although the "Search" works when I access it separately, when used within the populatingSavedSearch it doesn't work. It complains that no search was defined.

This is the error I get:
SearchLister module SearchSelectLister_0_0_0 was not given a search or a saved search name to power itself and thus cannot render any data.

This is the configuration I have:
<fieldset>
<input type="dropdown" token="idname">
<label>ID</label>
<populatingSavedSearch fieldForValue="idname" fieldForLabel="idname">search_ids</populatingSavedSearch>
<choice value="*">Any</choice>
</input>
<input type="time" />
</fieldset>

Could someone provide an example of how to set up these searches? Thanks for your help.

Ranga

0 Karma
1 Solution

emma
Splunk Employee
Splunk Employee

You should be able to do this in almost exactly the same way as you'd add a populatingSavedSearch, including extracting a field for value and field for label to create the fields in the dropdown. For example:

<input type="dropdown" token="username">
  <label>Select Name</label>
  <populatingSavedSearch fieldForValue="myfield" fieldForLabel="myfield">MySearch</populatingSavedSearch>
  <choice value="*">Any</choice>
</input>

Described here:

http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Exampleform#Create_a_dynamic_form_search_using_d...

Are you having problems with this configuration? If so, please copy in your XML so we can see what exactly you're trying to do.

View solution in original post

sranga
Path Finder

I downloaded the latest version of Splunk and this feature seems to work fine on that. Thanks for all the help.

0 Karma

emma
Splunk Employee
Splunk Employee

You should be able to do this in almost exactly the same way as you'd add a populatingSavedSearch, including extracting a field for value and field for label to create the fields in the dropdown. For example:

<input type="dropdown" token="username">
  <label>Select Name</label>
  <populatingSavedSearch fieldForValue="myfield" fieldForLabel="myfield">MySearch</populatingSavedSearch>
  <choice value="*">Any</choice>
</input>

Described here:

http://docs.splunk.com/Documentation/Splunk/5.0/Viz/Exampleform#Create_a_dynamic_form_search_using_d...

Are you having problems with this configuration? If so, please copy in your XML so we can see what exactly you're trying to do.

sranga
Path Finder

Thanks. Actually, I downloaded the latest version of Splunk and this works fine in that version. I shall check the version we have with our Splunk Admin and open up a bug accordingly

0 Karma

emma
Splunk Employee
Splunk Employee

can you copy in your XML and possibly the saved search conf? i suggest if this is really not working for you, that you contact support to file a bug. it sounds a bit buggy to me.

0 Karma

sranga
Path Finder

Yes, I can run the saved search on its own and "idname" is one of the fields present in the search. I tested it with a "test" view that referenced the saved search and it executed fine.

0 Karma

emma
Splunk Employee
Splunk Employee

What happens if you try to run that saved search "search_ids"? What kind of data are you getting back? is "idname" one of the fields that's present in that search?

0 Karma

sranga
Path Finder

Thanks for the response. I have a similar configuration, but it doesn't work for me.







search_ids

Any

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...