dropdown for the field

[splunkpoornima]

Hi all,

i have an log4j logs in that i have extracted the User names ...so now my field User has 79 user names what i need is i want a dropdown in that i want this 79 name to be in that list so that if i click any one of the name i want to see the log related to that Username

plz give an idea to proceed

thanks in advance,
poornima

[smolcj]

Cool... enjoy splunking 🙂

[splunkpoornima]

thanks guys..
its working!!!!

[sruthy]

searchtemplate>source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log" $username$|fields - _time </searchtemplate>

or
searchtemplate>source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log" $username$|fields host index ..... </searchtemplate>

[splunkpoornima]

<![CDATA[source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log"
| rex FIELD=_raw "User: (?.*)"
| stats count by User]]>

source="C:\Users\20875\Desktop\pros-Tomcat-AMGDCPROSAPPP1.log" $username$



after run this code.i got the table as above with time field ..but i want to remove that

[smolcj]

your search | fields - _time

[splunkpoornima]

please verify the attachment contains the ouput..

in that table i want to remove the _time coloumn alone

plz suggest the way

[Drainy]

A quick Google for, "Splunk forms drop down" revealed;

http://docs.splunk.com/Documentation/Splunk/4.3/Developer/AddDropDowns

Let us know if you hit any specific problem or issue

[splunkpoornima]

hi ayn i found the answer for that..

i used choice value ...

thanks

[Ayn]

Well, as you can see in the DOCS *hint*...

<default>    The default option to select.

If the default option cannot be found, the first option is selected.

[splunkpoornima]

Hi ayn,

I got the answer..but one small problem..

i have inserted the * but this * is not geting listed down in the dropdown

[Ayn]

stats values(User) returns just one event. That won't work. Study the link Drainy gave you. It clearly shows how all examples have one line per item in the dropdown.

[splunkpoornima]

I verifed the given link and i craeted the code as below

Pros_Source

User

|savedsearch"UserExtraction"

"UserExtraction" has source="AMGDCPROSAPPP1.log"| rex FIELD=_raw "User: (?.*)"|stats values(User)

correct me if i went wrong in the above code