Pass form field values to saved searches

[sranga]

Hi

I have a dynamic form that displays a chart. I was wondering if the following is possible:

1) Execute a "Saved Search" to populate the values for one of the form field's (dropdown) list. I tried using populatingSavedSearch and it does not work [see example below]
2) Execute the search for populating the chart in a schedule. I can do this for static searches. Since I have a need to pass in form field values to the search, this needs to work for dynamic searches. Can I replace the searchTemplate [see example below] with a searchName? If not, is there another way to specify running the search on a schedule?

Example configuration (does not work😞

<form>  
  <label>Saved Search</label>  
  <fieldset>  
    <input type="dropdown" token="id">
      <label>ID</label>
      <prefix>id="</prefix>
      <suffix>"</suffix>
      <populatingSavedSearch fieldForValue="idname" fieldForLabel="idname">saved_values
      </populatingSavedSearch>  
    </input>
    <input type="time" />
  </fieldset>
  <row>
    <chart>
      <searchTemplate>`summary` | search $id$</searchTemplate>
      <title>My Dynamic Saved Search</title>
    </chart>
  </row>  
</form>  

saved_values:

index="list_app" | top limit=0 idname | fields + idname | sort idname

summary:

index="my_app" source="test*"

Thanks for your help.

Ranga

[thall79]

Ok if I am reading this correctly are you wanting a savedsearch to populate a drop down box. Then from that drop down box you want to make a selection to generate a chart.

Have you tried using a SearchSelectLister:

http://www.splunk.com/base/Documentation/4.1.1/Developer/ModuleReference#SearchSelectLister

http://www.splunk.com/base/Documentation/4.1.1/Developer/HowToUseListers#SearchSelectLister

Then you could set the dashboard to refresh every X amount seconds and it will generate new data.

Travis.

[thall79]

Everything on the Dashboard would be refreshed at X time. In my main dashboard I begin my XML like this to refresh everything every 10 minutes:

Here is example of SearchSelectLister that I used for awhile, but rebuilt it using field searches and a LinkSwitcher which works better for my views.

http://www.splunk.com/support/forum:SplunkDev/3806

Travis.

[sranga]

Thanks. Yes, the problem statement you described is what I want. I shall look into the SearchSelectLister module. Would this result in the "default" value search being run every so often or would it actually run the search for all of the values in the list every X amount of time?

[sranga]

I've added the saved_values and summary search/search macros to the original question (above). As for the scheduled search, I was wondering if a dynamic search could be scheduled to run the search for all of the values in the input list periodically.

[gkanapathy]

Also, I don't understand what you mean when you say you want to run a search on a schedule, but also allow a user to dynamically populate in one of the (required, I would think) parameters of the search.

[gkanapathy]

you need to show us the definition of the saved_values saved search, as well as probably some of the data or output of the search. incidentally, and this isn't fundamental to your UI issue, your searchTemplate should be source="test*" AND $id$, not using the search operator unnecessarily.