Dashboards & Visualizations

How to use populatingSavedSearch of a form field?

Path Finder

Same question as here.

XML:

<form>
 <label>LIST</label>

<fieldset>

 <input type="dropdown" token="printer">
   <label>Select Printer</label>
   <populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
      printer_list
    </populatingSavedSearch>
 </input>

 <input type="time" />
</fieldset>

<row>
 <chart>
  <searchTemplate>index="printer-stats" printer=$printer$|stats values(Black) as Black values(Cyan) as Cyan values(Magenta) as Magenta values(Yellow) as Yellow by _time</searchTemplate>

   <title>Toner Stuff</title>
       <option name="charting.seriesColors">
       [0xF000000,0x00CDCD,0xCC0099,0xFFFF00]</option>
      <option name="charting.chart">area</option>
      <option name="charting.primaryAxisTitle.text">Time</option>
      <option name="charting.secondaryAxisTitle.text">Percent</option>
      <option name="charting.legend.placement">bottom</option>

  </chart>
</row>
</form>

$SPLUNK_HOME/etc/apps/PrinterStatus/local/savedsearches.conf:

[printer_list]
alert.suppress = 0
alert.track = 0
cron_schedule = * * * * *
description = gets list of all printers found using getstatus script
dispatch.earliest_time = 0
dispatch.latest_time = now
displayview = report_builder_display
enableSched = 1
search = index="printer-stats" |top limit=0 printer|fields + printer|sort printer
vsid = *:hb70ayyx

This search runs every minute and I can see recent results, and have set permissions to global, yet I still get

Module SearchSelectLister_0_0_0: Could not find a saved search named " printer_list ".

Tags (1)
0 Karma
1 Solution

Path Finder

Figured it out, too much whitespace for XML I guess, put

<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
      printer_list
    </populatingSavedSearch>

on one line:

<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">printer_list</populatingSavedSearch>

and boom, loads

View solution in original post

0 Karma

Path Finder

Figured it out, too much whitespace for XML I guess, put

<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
      printer_list
    </populatingSavedSearch>

on one line:

<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">printer_list</populatingSavedSearch>

and boom, loads

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!