XML form not working in Splunk 6.0.2

[d12harshal]

XML form is not working in Splunk 6 but same code is working in Splunk 5. Below is the code please help:

<form>
  <label>Search</label>

     <searchTemplate>search query | search field1 = $name$  </searchTemplate>

   <fieldset autoRun="true" submitButton="true">       
       <input type="text" token="name">         
        <label>Search</label>
        <default></default>
        <suffix>*</suffix>
       </input> 
     </fieldset>
    <row>
     <table> 
       <title>overview</title>
       <earliestTime>@d</earliestTime>
      <latestTime>now</latestTime>
        <option name="showPager">true</option>
        <option name="count">20</option>
        <option name="displayRowNumbers">true</option>
     </table>            
   </row>
</form>

Thanks in advance
Harshal

[gauldridge]

Try adding a value between the <default> tags. I don't know your real search string so I had to come up with my own. This form search works in Splunk 6:

<form>
    <label>Search</label>

    <searchTemplate>sourcetype="syslog" | search COMMAND = $name$  </searchTemplate>

    <fieldset autoRun="true" submitButton="true">       
        <input type="text" token="name">         
            <label>Search</label>
            <default>./</default>
            <suffix>*</suffix>
        </input> 
    </fieldset>
    <row>
        <table> 
            <title>overview</title>
            <earliestTime>@d</earliestTime>
            <latestTime>now</latestTime>
            <option name="showPager">true</option>
            <option name="count">20</option>
            <option name="displayRowNumbers">true</option>
        </table>            
    </row>
</form>

The only changes I made were the search string (so there would be results to test) and the addition of a default value. If you don't need a default value, you should remove the default tags entirely. The above form works just fine without a default (it just waits for the user to enter something in the input box and click Search).

[d12harshal]

I have fixed it the reason in my case is SOURCE contains "$" symbol and after putting escape character it is working fine.