How to use populatingSavedSearch of a form field?

[joshrabinowitz]

Same question as here.

XML:

<form>
 <label>LIST</label>

<fieldset>

 <input type="dropdown" token="printer">
   <label>Select Printer</label>
   <populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
      printer_list
    </populatingSavedSearch>
 </input>

 <input type="time" />
</fieldset>

<row>
 <chart>
  <searchTemplate>index="printer-stats" printer=$printer$|stats values(Black) as Black values(Cyan) as Cyan values(Magenta) as Magenta values(Yellow) as Yellow by _time</searchTemplate>

   <title>Toner Stuff</title>
       <option name="charting.seriesColors">
       [0xF000000,0x00CDCD,0xCC0099,0xFFFF00]</option>
      <option name="charting.chart">area</option>
      <option name="charting.primaryAxisTitle.text">Time</option>
      <option name="charting.secondaryAxisTitle.text">Percent</option>
      <option name="charting.legend.placement">bottom</option>

  </chart>
</row>
</form>

$SPLUNK_HOME/etc/apps/PrinterStatus/local/savedsearches.conf:

[printer_list]
alert.suppress = 0
alert.track = 0
cron_schedule = * * * * *
description = gets list of all printers found using getstatus script
dispatch.earliest_time = 0
dispatch.latest_time = now
displayview = report_builder_display
enableSched = 1
search = index="printer-stats" |top limit=0 printer|fields + printer|sort printer
vsid = *:hb70ayyx

This search runs every minute and I can see recent results, and have set permissions to global, yet I still get

Module SearchSelectLister_0_0_0: Could not find a saved search named " printer_list ".

[joshrabinowitz · Accepted solution]

Figured it out, too much whitespace for XML I guess, put

<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
      printer_list
    </populatingSavedSearch>

on one line:

<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">printer_list</populatingSavedSearch>

and boom, loads