This may be a long winded question ...
After upgrading one of our search head pools from 4.3.6 to Splunk 6.0 I'm finding that I'm having to make XML changes to many of the forms that worked fine in 4.3.6 ... This could be due to my having written poorly formatted code in the earlier version, or it could be due to a change in functionality ...
example: ... the
|inputlookup oradb.csv | table host,SID,RAC_INSTANCE,LIFECYCLE | where (host LIKE "$s_hostname$") AND (SID LIKE "$s_instance$")
The XML that applies to this template looked like this:
</fieldset>
<input type="text" token="s_hostname">
<label>Enter a hostname or pattern</label>
<default></default>
<suffix>%</suffix>
</input>
</fieldset>
<fieldset>
<input type="text" token="s_instance">
<label>DB Instance Name</label>
<default></default>
<suffix>%</suffix>
</input>
</fieldset>
Now in order to get this to work ... I had to make the following changes:
{code}
</fieldset>
<input type="text" token="s_hostname">
<label>Enter a hostname or pattern</label>
<! I had to add the '%' in the default block ... which worked without it in 4.3.6 -->
<default>%</default>
<suffix>%</suffix>
</input>
<! I removed the end and beginning fieldset blocks -->
<input type="text" token="s_instance">
<label>DB Instance Name</label>
<! I had to add the '%' in the default block ... which worked without it in 4.3.6 -->
<default>%</default>
<suffix>%</suffix>
</input>
</fieldset>
Also ... in Splunk 6, the default values are visible in the input boxes of the form ... I assume that is now expected behavior ... If anyone has a better suggestion for formatting this XML ... I'd welcome it.
Correct, you should include all of your inputs within a single fieldset.
Regarding your use of default, what are you trying to do here? With your current configuration, the user will see "%" within the text input form when they load the page, and if they just click search, the token value will be "%%". Is that expected?
Some questions here:
So in this case, you probably don't need any default here as the suffix will do what you need.
Thanks for your quick answer ...
So, the reason I used a default of '%' and a suffix of '%' was to give the user the option of entering a pattern ( which would be appended with the wildcard ... ) or nothing so that the search would be the wildcard on its own.
Cheers,
Paul