passing variables within a form

[DTERM]

I've trying to pass variables within a form. It does not appear to be working. The code below produces the dropdown. The dropdown works. I need to pass the variable from the dropdown to the rest of the form to produce the charts. Any idea why the variable is not passed or why the charts are not displayed?

Thanks.

<form class="formsearch">

ZHost

index=MyApp host=host

Select ZHost All |inputlookup zhost.csv | fields + zhost Last 7 days

index=myapp host=$zhost$ | top serviceName limit="10"
pie
all





index=myapp host=$zhost$ | top productName limit="10"
bar
all

[cphair · Accepted solution]

Hi dterm,

1. Capitalization matters in Splunk tags. Use populatingSearch, searchTemplate, fieldForValue, and fieldForLabel.
2. I don't think you need the searchTemplate entry anyway; my search works without it.
3. Pass $host$ instead of $zhost$ to your search.
4. I changed the tag search to searchString in your chart section and got a chart to display for my sample data.

Let me know if this helps.

[DTERM]

Worked great!! thanks so much!!