Splunk Search

SavedSearch containing $field_name$

Ant1D
Motivator

Hey,

I have written the following code for a form:

  <form>

         <label>Combo box test</label>

        <!-- <searchName>Test SavedSearch</searchName> -->
        <searchTemplate>index="general_logs" name=$name$ | fields name type source</searchTemplate> 

        <fieldset submitButton="false">
            <input type="dropdown" token="name" searchWhenChanged="true">
            <label>Name</label>
            <populatingSavedSearch fieldForValue="name" fieldForLabel="name">names_list</populatingSavedSearch>
            <choice value="*">Any</choice>
            </input>
            </fieldset>


            <row>
               <table>
                  <title>Test Data</title>
                  <option name="count">50</option>
                  <option name="showPager">true</option>
               </table>
            </row>

  </form>

At present, each time a name is selected from the dropdown list, the name selected is used to automatically run the search inside the searchTemplate tags.

I tried to use a scheduled saved search (which is identical to the search in the searchTemplate tags) to achieve the same results (see commented out searchName tags in code above) but it does not produce the same results when I choose a name from my dropdown list. I don't think that the field $name$ in my saved search is being populated with the data selected in my dropdown list. How can I get this to work?

Thanks in advance for your help.

0 Karma
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Saved searches cannot be used to create form searches. Well, you can but you still need to use searchTemplate as follows:

 <searchTemplate>| savedsearch "<savedsearch-name>" name=$name$ </searchTemplate> 

So basically, the UI right now can only replace form inputs in a searchTemplate

For more info on how to use the savedsearch command look at the manual: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Savedsearch

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

Saved searches cannot be used to create form searches. Well, you can but you still need to use searchTemplate as follows:

 <searchTemplate>| savedsearch "<savedsearch-name>" name=$name$ </searchTemplate> 

So basically, the UI right now can only replace form inputs in a searchTemplate

For more info on how to use the savedsearch command look at the manual: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Savedsearch

Get Updates on the Splunk Community!

hadoop vs splunk

hiIn big data can we replace hadoop by splunk ? and why?do splunk do&nbsp; all hadoop fonctionality

logs are not getting from Linux machine

logs are not getting from Linux machineI am using Splunk cloud trial and in a Linux machine and installed ...

DateParserVerbose issue for Symantec Email Security Add-on for Splunk

Hi All,We are observing high number of parsing issues on sourcetype= symantec:email:cloud:atp. We haven't done ...