creating the dropdown

[splunkpoornima]

hi all ,

i have the field called TaskAction it has upto some 25 fields i want to create dropdown fo those filed how can i do that

pls help me with code

[sdaniels]

As Ayn said, download this app and you'll find examples with code for the dropdown you would like. Look in the folder ui_examples/default/data/ui/views/

http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41

form_dropdown.xml

<form>
    <label>Simple select drop down</label>

    <!-- define master search template, with replacement tokens delimited with $ -->
    <searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</searchTemplate>
    <earliestTime>-30d</earliestTime>
    <latestTime>-0d</latestTime>

    <fieldset>
        <!-- Define a simple dropdown form driven by a search -->
        <input type="dropdown" token="series">
            <label>Select series</label>
            <populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series]]></populatingSearch>
            <choice value="*">Any</choice>
        </input>
    </fieldset>

    <row>
        <!-- output the results as a 50 row events table -->
        <table>
            <title>Matching events</title>
            <option name="count">50</option>
        </table>
    </row>
</form>

[smolcj]

the problem i found is , the value assigned to $source$ is like C:\Users\homefolder\filename.txt
which is the path of my source file but the one which is needed in the Splunk search command is something like

C:\\Users\\homefolder\\filename.txt

So how to replace "\" by "\\"(double backslash) in search command 😞 please help
thankyou

[smolcj]

Oh! i am sorry, i didn't change $test$ before posting, actually this form was working fine with a textbox and at that time i used token name as "test" for it. and when i tried to replace textbox with a dropdownbox i used another name for testing what's wrong with the name test, still first chart has to work. but it is not working.. even if i replace $test$ with $sources$ , nothing seems to be changed in my result. it is not generating any chart.

[sdaniels]

The other thing i might do is simply the view and just get one chart working based on selecting a value from the drop down.

[sdaniels]

What is the $test$ for...did you replace that with $sources$ previously and it still isn't working? Are you not getting any charts to populate?

[smolcj]

Hi, i have tried with the above sample, but i am not getting the return value from the dropdown box in the variable and not able to do the search effectively.. here is my code. can u tell me what's wrong with my code. thanks for your valuable time.

<form>
  <label>MAPPING_drop down</label>

   <fieldset>



  <input type="dropdown" token="sources">
   <label>Source:</label>
   <populatingSearch fieldForValue="source" fieldForLabel="source">
      index=main sourcetype=pc_log |chart count over source
    </populatingSearch>
</input>

      <input type="time" />
  </fieldset>

  <row>
    <chart>
  <title>MAPPING:WRITER </title>

      <searchTemplate>
    index=main source=$sources$ PC_level="WRITER_*"| chart count by PC_level
  </searchTemplate>

      <option name="charting.chart">pie</option>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>


    </chart> 
    <chart>
      <searchTemplate>
          index=main source=$test$ PC_level="LKPDP_*" OR PC_level="MAPPING" OR PC_level="TRANSF_*" | chart count by PC_level  </searchTemplate>
      <title>MAPPING:TRANSFORMATION</title>
      <option name="charting.chart">pie</option>
      <option name="count">10</option>
      <option name="displayRowNumbers">true</option>
    </chart>
  </row><row>
     <chart>
     <searchTemplate> 
       index=main source=$test$ eventtype="PC_READER" |chart count by PC_level   </searchTemplate>
      <title>MAPPING:READER</title>
      <earliestTime>0</earliestTime>
      <option name="charting.chart">pie</option>
      <option name="count">50</option>
      <option name="displayRowNumbers">true</option>
    </chart>
  </row>

</form>`

[Ayn]

The UI examples app has info on how to do dropdowns.