Getting Data In

How to populate a radio button input with the unique values of a field?

HattrickNZ
Motivator

I have the following radio button input that I would like to populate with the unique values of elementType

 <input type="radio" token="elementType">
        <label>Element Types</label>
        <choice value="*">All</choice>
        <populatingSearch fieldForValue="elementType" fieldForLabel="elementType">
          <![CDATA[index=core host="snzclakl598" | head 1000 | top elementType ]]>
        </populatingSearch>
        <default>*</default>
</input>

Do I need to use the token elementType further down in a search in a panel for the radio button input to work?
How do I set my to search for randomText* criteria? is this done in the

  • * in the search in
  • the radio button input in the
  • search in the search string in the panel

    ... elementType=$elementType$ ... | timechart span=$timespan$ max(c100991388) by measObjLdn | eval threshold=80

Tags (3)
0 Karma

chimell
Motivator

Hi HattrickNZ
Try this xml code

<form>
<label>Form Input Example (Time)</label>
<description/>
     <input type="radio"  token="elementType">
    <label>Element Types</label>
    <choice value="*">All</choice>
    <populatingSearch fieldForValue="elementType" fieldForLabel="elementType">
    <![CDATA[index=core host="snzclakl598" | head 1000 | top elementType ]]>
    </populatingSearch>
    <default>*</default>
</input>

<input type="time"  token="timespan" searchWhenChanged="true">
<label>Select time range</label>
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>

<row>
<panel>
<chart>
<title> </title>
 <searchString>
index=core host="snzclakl598" elementType=$elementType$  ...... | timechart  span=$timespan$  max(c100991388) by measObjLdn  | eval  threshold=80
 </searchString>
<earliestTime>$timespan.earliest$</earliestTime>
<latestTime>$timespan.latest$</latestTime>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</form>
0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

You want something like this:

<input type="radio" token="elementType" searchWhenChanged="true">
      <label>Element Types</label>
      <search>
        <query>index=core host="snzclakl598" | head 1000 | top elementType</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
      <fieldForLabel>elementType</fieldForLabel>
      <fieldForValue>elementType</fieldForValue>
      <prefix>elementType="</prefix>
      <suffix>"</suffix>
    </input>

Because I've used the prefix and suffix tags the search would be something like this:

... $elementType$  ... | timechart  span=$timespan$ max(c100991388) by measObjLdn  | eval  threshold=80

which would then translate to:

... elementType=value_from_radio_button  ... | timechart  span=$timespan$ max(c100991388) by measObjLdn  | eval  threshold=80
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

HattrickNZ
Motivator

does token="elementType" map to this $elementType$ in the search. then why have a sepereate search in the radio button ``

What I want to do is fill the radio button with all the values of elementType

0 Karma

rsennett_splunk
Splunk Employee
Splunk Employee

the search is what does the filling. calling it elementType doesn't do anything but self annotate the code. I could have called it "mytoken" and used that populating search and it would still work... because the
elementType tells it which value from the populating search it should use to stuff the token... (the values for the elementType field...)

Try it.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...