Getting Data In

How to populate a radio button input with the unique values of a field?

Motivator

I have the following radio button input that I would like to populate with the unique values of elementType

 <input type="radio" token="elementType">
        <label>Element Types</label>
        <choice value="*">All</choice>
        <populatingSearch fieldForValue="elementType" fieldForLabel="elementType">
          <![CDATA[index=core host="snzclakl598" | head 1000 | top elementType ]]>
        </populatingSearch>
        <default>*</default>
</input>

Do I need to use the token elementType further down in a search in a panel for the radio button input to work?
How do I set my to search for randomText* criteria? is this done in the

  • * in the search in
  • the radio button input in the
  • search in the search string in the panel

    ... elementType=$elementType$ ... | timechart span=$timespan$ max(c100991388) by measObjLdn | eval threshold=80

Tags (3)
0 Karma

Motivator

Hi HattrickNZ
Try this xml code

<form>
<label>Form Input Example (Time)</label>
<description/>
     <input type="radio"  token="elementType">
    <label>Element Types</label>
    <choice value="*">All</choice>
    <populatingSearch fieldForValue="elementType" fieldForLabel="elementType">
    <![CDATA[index=core host="snzclakl598" | head 1000 | top elementType ]]>
    </populatingSearch>
    <default>*</default>
</input>

<input type="time"  token="timespan" searchWhenChanged="true">
<label>Select time range</label>
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>

<row>
<panel>
<chart>
<title> </title>
 <searchString>
index=core host="snzclakl598" elementType=$elementType$  ...... | timechart  span=$timespan$  max(c100991388) by measObjLdn  | eval  threshold=80
 </searchString>
<earliestTime>$timespan.earliest$</earliestTime>
<latestTime>$timespan.latest$</latestTime>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</form>
0 Karma

Splunk Employee
Splunk Employee

You want something like this:

<input type="radio" token="elementType" searchWhenChanged="true">
      <label>Element Types</label>
      <search>
        <query>index=core host="snzclakl598" | head 1000 | top elementType</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
      <fieldForLabel>elementType</fieldForLabel>
      <fieldForValue>elementType</fieldForValue>
      <prefix>elementType="</prefix>
      <suffix>"</suffix>
    </input>

Because I've used the prefix and suffix tags the search would be something like this:

... $elementType$  ... | timechart  span=$timespan$ max(c100991388) by measObjLdn  | eval  threshold=80

which would then translate to:

... elementType=value_from_radio_button  ... | timechart  span=$timespan$ max(c100991388) by measObjLdn  | eval  threshold=80
With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma

Motivator

does token="elementType" map to this $elementType$ in the search. then why have a sepereate search in the radio button ``

What I want to do is fill the radio button with all the values of elementType

0 Karma

Splunk Employee
Splunk Employee

the search is what does the filling. calling it elementType doesn't do anything but self annotate the code. I could have called it "mytoken" and used that populating search and it would still work... because the
elementType tells it which value from the populating search it should use to stuff the token... (the values for the elementType field...)

Try it.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma