passing variables from a dropdown into saved searches.

[DTERM]

There have been several posts about this, but I did not find any that address this requirement.

I need to modify a form to include a drop down list. I've implemented a drop down list that pulls information from a lookup table. Now I need to pass these variables to predefined searches I've implemented in the view. How do I do that? I've included the code with some comments below.

Thanks in advance...

<form class="formsearch">

Daily Summary
index=MyApp host=$host

Select MyApp Source |inputlookup hosts.csv | fields + VHost Any Last 15 minutes

Daily Summary

Daily Summary

ServiceName

pie
all


ProductName

bar
all




TopHosts

pie
all


TopHosts

bar
all




TopSeverity

pie
all


TopSeverity

bar
all




All_Shifts

line
all

[lguinn2]

In your searchTemplate, host=$host won't work. It needs to be

host=$host$ 

and better if you put "" around it, in case you get a weird value in the variable ...

host="$host"

You can't pass variables into saved searches. However, you could use macros.
But I don't know that what you are trying to do is really going to work anyway - try it, and ask more questions.

I would suggest that you download the Splunkbase app Splunk UI Examples for 4.1+ to see how some of this can be done. It's a year old, but the examples are still excellent, especially for advanced dashboards. You should probably also look at Form Searches in the Developing... Manual, especially this section: Step 3 Form Output