How to pre-populate text boxes by passing tokens using simple xml in Splunk 6?

[_gkollias]

Hi All,

I have a dashboard that allows users to drilldown to a page where they can actually re-submit receipts to the customer. Since the recipient emails are being logged, I want to auto populate the To and CC fields in the email page rather than having them manually add them (there can be a lot of emails :))

How can I pre-populate text boxes in Splunk 6 using simple xml?

Any insight would be much appreciated.

Thanks!

[_gkollias · Accepted solution]

Solved - I used the default tag with the fields as token for the value. The only caveat I discovered was that I actually need to table those values in the first page before I can pass it to the drill-down page.

To:
$emailTo$

[somesoni2]

Try something like this (run anywhere sample with two text boxes)

Main page(page1.xml)

<dashboard>
  <label>Page1</label>
  <row>    
      <table>
        <title>Sourcetype Distribution</title>
        <searchString>index=_internal earliest=-1h@h | stats count by sourcetype component</searchString>
        <earliestTime/>
        <latestTime/>
        <drilldown>
  <link>
  /app/search/page2?form.sourcetype=$row.sourcetype$&amp;form.component=$row.component$
  </link>
</drilldown>
      </table>  
  </row>
</dashboard>

drilldown page (page2.xml)

<form>
  <label>Page2</label>
  <fieldset>
  <input type="text" token="sourcetype">
    <label>sourcetype</label>
    <default></default>   
  </input>
     <input type="text" token="component">
    <label>component</label>
    <default></default>   
  </input>
</fieldset>
  <row>   
      <event>
        <title>Events by Sourcetype and component</title>
        <searchString>index=_internal sourcetype=$sourcetype$ component="$component$" earliest=-1h@h</searchString>
        <earliestTime/>
        <latestTime/>
      </event>   
  </row>
</form>

[actionabledata]

I know it was many years ago, but your answer helped, so thank you for your response somesoni2. I did have to update the XML code for compliance with the recent version of Splunk, but that was simple.

My situation is a bit different in that I need to extract a segment from a clicked field (UID) to become the form.field input for my drilldown page.

This doesn't seem hard, but I cannot make it work.

Example:

My UID field looks like ABC123:456456:99887766 and I need to pass the first segment (ABC123) to the drilldown page when a user clicks on that table row. To ensure uniqueness, this UID field is a concatenation of several fields within my algorithm. The original field is not available since it gets consumed with stats commands.

I have attempted within the <drilldown> section of the main page to perform a rex extraction and then use the resulting token within the same <drilldown> section. But the rex extraction does not seem to execute.

I also tried performing the rex extraction within the drilldown page using the passed UID value. I can extract the value but can't seem to populate the form with the value.

Thank you for any help you can provide.