Getting Data In

Can I use a text input form to filter down to the top user results for my search?

vil505
Explorer

Is there a general way for me to use the text input in a form to filter it down to the top users, depending on the number I enter in the text?

0 Karma

somesoni2
Revered Legend

Try like this

<form>
  <label>TestBoxAsTopLimit</label>
  <fieldset submitButton="false">
    <input type="text" token="toplimit">
      <label>Top Limit</label>
      <default>10</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | head 10000 | top sourcetype limit=$toplimit$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

vil505
Explorer

That doesn't work. It just says "Search is waiting for input."

Here is the xml I'm working with:

<form>
  <label>Test Form for Sorting</label>
  <row>
    <panel>
      <input type="text" token="toplimit"></input>
      <table>
        <search>
          <query>index=* host="prd-p-242xf4n33bzp"| head 10000|top customer_name limit=$toplimit$</query>
          <earliest>-15</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.legend.placement">right</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart">bar</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

sundareshr
Legend

Add a default value to your input. Like this

<input type="text" token="toplimit">
  <default>20</default>
</input>
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...