form : view results

[LauraBre]

Hello,

I create a form with "single" but we can't see the results of the search button. How can do it to have a link "view result".

Thanks by advance for your answer.

This is a part of my xml file:

<form>

...

      <searchString>source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PA_HOST="|tpwacs01v.priv.atos.fr" SD_STAT_PA="YES" | stats count | rangemap field=count severe=0-0 elevated=1-40 default=low</searchString>

      <title>Host: tpwacs01v.priv.atos.fr</title>

      <earliestTime>-7d</earliestTime>

      <option name="beforeLabel">PA YES : </option>

      <option name="classField">range</option>

      <option name="field">count</option>

    </single>

  </row>

...
</form>

[Drainy]

Right, so I know how to do this via advanced XML so that is what my answer will be in, its quite easy once you get into it and generally most users end up having to jump into it sooner or later 🙂
As per;
http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/ModuleReference

You want;

linkFields
Specify whether to just link the result, or include labels. To link the result and both labels, specify "result,beforeLabel,afterLabel"
defaults to: result

linkSearch
Specify a valid complete search query to turn the result into a clickable link

To convert your existing dashboard to advanced XML just append ?showsource=1 to the end of the URL. As an example I have created a singleValue for you below in advanced XML;

Or at least I would if Splunkbase would let me paste it properly! I've put it here; http://pastebin.com/Q3GFK60z

The way you mention in your question, with a click to view results, can cause formatting issues with singleValues but if you really want you can do it with a ViewRedirectorLink module as per the module reference above, just reply if you're after that.

[smolcj]

is it possible to pass the same through linkview? like along with the viewname foreg flashtimeline?source=$form.sources$
something like that
please help

[smolcj]

How can we add a dropdown box variable to this link search?

[LauraBre]

Thx very much for your answer. I create a view following yours links. I have a problem when I go on the link. The error is:Splunk cannot find the "dashboard" view.This page was linked to from http://odpc:8000/en-US/app/ACS/ACS_alertes.
This is my xml file :

[Drainy]

so lets say that your dashboard is called bobsthings. You would go to the URL http://SPLUNKSERVER:8000/en-GB/app/search/bobsthings?showsource=1 assuming you are using port 8000, not SSL and en-GB 🙂 (although that will work anyway, regardless)

[LauraBre]

Thx for your answer. I don't understand very well how have I to do to convert my dashboard because I don't have url in my xml file.

<?xml version='1.0' encoding='utf-8'?>



UVB : Error Codes



...

my search

-7d
VE YES:
range
count