Getting Data In

Can I use a text input form to filter down to the top user results for my search?

vil505
Explorer

Is there a general way for me to use the text input in a form to filter it down to the top users, depending on the number I enter in the text?

0 Karma

somesoni2
Revered Legend

Try like this

<form>
  <label>TestBoxAsTopLimit</label>
  <fieldset submitButton="false">
    <input type="text" token="toplimit">
      <label>Top Limit</label>
      <default>10</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | head 10000 | top sourcetype limit=$toplimit$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

vil505
Explorer

That doesn't work. It just says "Search is waiting for input."

Here is the xml I'm working with:

<form>
  <label>Test Form for Sorting</label>
  <row>
    <panel>
      <input type="text" token="toplimit"></input>
      <table>
        <search>
          <query>index=* host="prd-p-242xf4n33bzp"| head 10000|top customer_name limit=$toplimit$</query>
          <earliest>-15</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.legend.placement">right</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart">bar</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

sundareshr
Legend

Add a default value to your input. Like this

<input type="text" token="toplimit">
  <default>20</default>
</input>
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...