Show search result in a readonly textbox

[john]

I want to display search result value in a readonly textbox.Iam using advanced Xml.Please help

[sideview · Accepted solution]

I recommend using the Sideview Utils app, or it's premium version, the [http://sideviewapps.com/apps/sideview-development-kit/ Sideview Development Kit].

Those apps both add custom modules that you can mix and match with the core Splunk modules. You can use as little or as much of the new stuff as you want, and they both have a module called 'HTML' that can use to display any HTML, and do $foo$ replacement at search time anywhere into that HTML.

I can read your question in several different ways, and since I can't tell which one it actually is, here's all the answers to the different versions:

1) If you want to show the value that the user has selected in a Pulldown module above, and the 'name' param of that Pulldown is "foo", then you would do this.

<module name="HTML">
  <param name="html"><![CDATA[
    <input type="text" readonly="readonly" value="$foo$"/>
  ]]></param>
</module>

2) If on the other hand, you have a Pulldown that kicks off a search, and you want to reach back into the search results for that search, get a particular field value from the first row, then display it as a readonly textfield, but then do nothing else besides displaying it:

<module name="HTML">
  <param name="html"><![CDATA[
    <input type="text" readonly="readonly" value="$results[0].myField$"/>
  ]]></param>
</module>

3) Much like 2, but you DO want to ALSO use the field value for more than just display. Like if you want to use it in other searches, or have it prepopulate other elements etc...

For these cases you'll want to use the ResultsValueSetter module. ResultsValueSetter reaches into the first row of the search results, pulls out the values of one or more fields, and makes those fields available as $fieldName$ keys, anywhere downstream from itself. It looks like this:

...other modules upstream, including a Search module, which specifies 
a search whose results contain a field called 'myField'... 

<module name="ResultsValueSetter">
  <param name="fields">myField</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      <input type="text" readonly="readonly" value="$myField$"/>
    ]]></param>
  </module>

  <module name="Search">
    <param name="search">$myField$ | timechart count</param>

    ....Then the rest of your modules go here, like tables/charts/etc..
  </module>
</module>

ValueSetter is a useful utility module that you can use to set arbitrary keys at useful points, or to wrap existing $foo$ keys, or url encode them, etc.. ResultsValueSetter is much the same except that it's raw materials are not the existing $foo$ space, but rather the field values of the search results at that point. Hopefully it makes sense. When you get into advanced use cases you use these two modules quite often.

[john]

Thanks Nick

[MHibbin]

hello_bibin18,

Can you provide a little more detail in your request please. My assumption on reading this is that you do not want the "drilldown" functionality enabled is this correct? (i.e. when the functionality is enabled, you can select an element of the view and be redirected to another view/visualisation).

On the assumption that you wish to disable the drilldown, you should be able to remove the following parts of your advanced XML (if you are using the default values):

• The "ConvertToDrilldownSearch" module
• The "ViewRedirector" module, and its "viewTarget" parameter
• The "ViewRedirectorLink" module, and its "viewTarget" parameter

For example the default drilldown would be:

<module name="ConvertToDrilldownSearch">
  <module name="ViewRedirector">
    <param name="viewTarget">flashtimeline</param>
  </module>
</module>

-and-

<module name="ViewRedirectorLink">
  <param name="viewTarget">flashtimeline</param>
</module>

I would of course, "clone" the view through the function in Manager (i.e. Manager >> User Interface >> Views >> Clone (on the row for your view) before making the changes. If you do not wish to clone the view, I would still copy the raw XML to a notepad/text file to have a backup ready.

You will also need to make sure you have the correct number of closing tags in your XML

Regards,

MHibbin

P.S. If a solution provided by an answer to any of your questions has worked. Would you mind marking the answer as "accepted" (the tick next to the answer), as this will help the community know if an answer works, or whether a question still needs another answer (i.e. different people have different ways to reach the same goal)

[john]

Hi MHibbin, I am using two dropdowns in advanced XML.Value for second dropdown is getting dynamically from first dropdown search same way i want to show that value in a readonly textbox (so that user cannot change that value) instead of second dropdown and i want to use that textbox value for futher search.