Splunk Search

Drop down not working with Metadata query.

Communicator

This is the View which I created with a form which contains a dropdown to list department names.All the hosts are tagged with the Dept Names eg. ACC,CORP,FIN.There are about 1500 hosts.

<form>
    <label>Log Sources that are reporting</label>


<searchTemplate>| metadata type=hosts   | fields + host, firstTime, lastTime,totalCount   | convert ctime(firstTime)   | convert ctime(lastTime)  | sort - host | TAGS | search tag::host=$bussiness$ </searchTemplate>
   <earliestTime>-7d</earliestTime>

    <fieldset>
        <input type="dropdown" token="bussiness">
            <label>Select Business</label>
            <choice value="CORP">Corporate</choice>
      <choice value="ACC">Accounts</choice>
      <choice value="Fin">Finance</choice>
        </input>
    </fieldset>

    <row>
        <!-- output the results as a 50 row events table -->
        <table>

            <title>Matching events</title>
            <option name="count">50</option>
        </table>
    </row>
</form>

After I submit the form after selecting CORP from the dropdown option I do not get any results.However when I click on the view results button I see that the query has "None" inserted in it.

| metadata type=hosts   | fields + host, firstTime, lastTime,totalCount   | convert ctime(firstTime)   | convert ctime(lastTime)  | sort - host | TAGS None | search tag::host=CORP

Could you someone help me out with this one as this is urgent?

Tags (2)
0 Karma
1 Solution

Communicator

In your search | sort - host | TAGS | search tag::host=$bussiness$ have you tried adding the word host to TAGS?

| sort - host | tags host | search tag::host=$bussiness$

Travis.

View solution in original post

Communicator

In your search | sort - host | TAGS | search tag::host=$bussiness$ have you tried adding the word host to TAGS?

| sort - host | tags host | search tag::host=$bussiness$

Travis.

View solution in original post

Communicator

Thanks.That worked.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!