Splunk Search

SavedSearch containing $field_name$

Ant1D
Motivator

Hey,

I have written the following code for a form:

  <form>

         <label>Combo box test</label>

        <!-- <searchName>Test SavedSearch</searchName> -->
        <searchTemplate>index="general_logs" name=$name$ | fields name type source</searchTemplate> 

        <fieldset submitButton="false">
            <input type="dropdown" token="name" searchWhenChanged="true">
            <label>Name</label>
            <populatingSavedSearch fieldForValue="name" fieldForLabel="name">names_list</populatingSavedSearch>
            <choice value="*">Any</choice>
            </input>
            </fieldset>


            <row>
               <table>
                  <title>Test Data</title>
                  <option name="count">50</option>
                  <option name="showPager">true</option>
               </table>
            </row>

  </form>

At present, each time a name is selected from the dropdown list, the name selected is used to automatically run the search inside the searchTemplate tags.

I tried to use a scheduled saved search (which is identical to the search in the searchTemplate tags) to achieve the same results (see commented out searchName tags in code above) but it does not produce the same results when I choose a name from my dropdown list. I don't think that the field $name$ in my saved search is being populated with the data selected in my dropdown list. How can I get this to work?

Thanks in advance for your help.

0 Karma
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Saved searches cannot be used to create form searches. Well, you can but you still need to use searchTemplate as follows:

 <searchTemplate>| savedsearch "<savedsearch-name>" name=$name$ </searchTemplate> 

So basically, the UI right now can only replace form inputs in a searchTemplate

For more info on how to use the savedsearch command look at the manual: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Savedsearch

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

Saved searches cannot be used to create form searches. Well, you can but you still need to use searchTemplate as follows:

 <searchTemplate>| savedsearch "<savedsearch-name>" name=$name$ </searchTemplate> 

So basically, the UI right now can only replace form inputs in a searchTemplate

For more info on how to use the savedsearch command look at the manual: http://www.splunk.com/base/Documentation/4.1.5/SearchReference/Savedsearch

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...