Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Getting a multiple input search to search corr...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Getting a multiple input search to search correctly
I am having trouble getting my form search to bring back anything. The xml is accepted by splunk but the search won't bring back anything. It always says 0. here is the xml code...
<form>
<label>My Search Engine</label>
<searchTemplate>"$SearchHere$" | head 250</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>
<html>
Enter a sourcetype in the field below and this view will pull back the most recent 100 events from the metrics log concerning that sourcetype.
</html>
<fieldset>
<input type="text" token="username">
<label>Enter a user name</label>
<default>Last 24 Hours</default>
</input>
</fieldset>
<row>
<chart>
<title>User logins</title>
<option name="charting.chart">pie</option>
</chart>
<event>
<title>Matching events</title>
<fields>_raw</fields>
<option name="count">250</option>
</event>
</row>
</form>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmm. You example looks like you tried 5 different things and none of it is consistent. Here are some things to fix up:
- Your HTML message mentions "sourcetypes" but nothing else seems to refer to them.
- Your default value for "username" looks like a value for a time range
- You are trying to build a
<chart>without using achartortimechartcommand in your search. - You have a mysterious variable named
$SearchHere$which you aren't actually setting up as an input anywhere.
I second hiddenkirby's suggestion to checkout the ui-examples app.
Another approach could be to build a few dashboards using splunk's dashboard building wizard and review the XML it generates for you. This is not a bad way to get started. If you haven't walked though the forms how intro in the docs, that's another good place to start:
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What happens when you remove the doublequotes in your searchTemplate?
What happens if you add a specific index?
index="myindex" username=$username$ | head 250
Downlaod ui-examples app from splunkbase and install it.
Look at the simplified xml -> inverted flow example.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
