I have a few views implemented like below in my app.
<form class="formsearch"> <label>My Dashboard</label> <fieldset> <input type="text" token="application" searchWhenChanged="true"> <label>Application:</label> <default>*</default> </input> <input type="time" searchWhenChanged="true"/> </fieldset> <row> <html><center><h1>My Dashboard</h1></center></html> </row> <row> <chart> <title>A simple chart</title> <searchTemplate>`filter($application$)` `sample_macro`</searchTemplate> <option name="charting.chart">line</option> <option name="charting.chart.nullValueMode">connect</option> </chart> </row> </form>
Is it possible to have a URL which directly lands to this view with an $application$ name set (so that I can use a HTTP request, either GET/POST). I'm able to land to the view with the view name, but I couldn't find how to populate the input field values with URL.
Incase this wouldn't work, I'd like ideas on how to implement this feature.
Any help is appreciated.
Thank you, Krishna
You cannot do this with the default Splunk UI unfortunately. Neither views built with the Simplified XML (like yours) nor views built with the Advanced XML have the ability to prepopulate fields reliably from the arguments in the URL.
However it's not all bad news. I have made an app available on Splunkbase called sideview_utils, and if you write your views in the advanced XML, you have sideview_utils installed on the Splunk instance, and in your app(s) you use certain Sideview modules instead of certain core Splunk modules, then you can prepopulate from the URL very reliably.
The sideview_utils app contains 20-some views that act as it's own documentation and examples. Download it and check it out if you have time.