Issue with simple XML dropdown search

[MHibbin]

SplunkBase,

I have a query about dropdown searches using the simple XML editor in Splunk. I fear I am missing something blindingly obvious, but I just can't seem to see it.

I started by creating a view which includes a search (text input) for a user and displays a table of results, which works. However when I change the input to dropdown, and add the populating search. I receive the following error...

SearchLister module SearchSelectLister_0_1_0 was not given a search or a saved search name to power itself and thus cannot render any data.

Below is the XML I have edited...

<form>
  <label>User Search (DropDown Selecter)</label>
  <searchTemplate>sourcetype=logs user=$username$ | table _time user message</searchTemplate>

  <fieldset>
    <input type="dropdown" token="username" />
      <label>Select user name</label>
      <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
      <default>*</default>
  </fieldset>

  <row>
    <table>
      <title>User message activity (Last 100)</title>
        <option name="showPager">true</option>
        <option name="count">100</option>
    </table>
  </row>

</form>

Any assistance would be appreciated and many thanks in advance.

Regards,

MHibbin

[Ayn · Accepted solution]

You're closing the dropdown <input> tag immediately but you should be keeping it open and run your populatingSearch inside the input section. So:

<input type="dropdown" token="username">
  <label>Select user name</label>
  <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
  <default>*</default>
</input>

[Ayn]

That is possible. It might be better to discuss that in the thread you created yourself though... 🙂

[monicato]

@MHibbin, I'm not quite sure, but my populating search is basically searching through millions of logs to find the name of different products. And the complete search returns about 150 different product names. Is there any way to have a saved search and then i could extract the saved search for all the products names instead of having to go through all the logs each time my view is loaded?

[MHibbin]

@monicato, No I never had those issues, what is the search you are using? ... how long does it take running in flashtimeline?

[monicato]

On a different note, @MHibbin, is your populating search taking an incredibly long time to load for the dropdown? I have a problem where my populating search takes 30min+ to complete. The only solution I could think of was listing static options for my dropdown... any ideas to speed the populating search up? ~thanks!

[MHibbin]

Thanks Ayn, I knew it would be blindingly obvious... I was determined in thinking it was the search string, so didn't look else where!