Splunk Search

allow-custom-value doesn't work in Splunk 7.2.3

asemle
Explorer

I've built a custom alert action with a UI. One of my inputs is dynamic, and populated from a splunk search. Here is the markup in custom alert HTML file.

I need the ability to enter a custom value as well, but allow-custom-value has no impact. According to this code sample it should work: https://docs.splunk.com/Documentation/Splunk/6.5.2/AdvancedDev/CustomAlertUI#Dynamic_input_controls

<splunk-control-group label="THINGID">
        <splunk-search-dropdown name="action.myapp.param.thingid"
            search="host=things| sort thingid | table thingid thingnum| dedup thingid"
            label-field="thingnum" value-field="thingid" 
            allow-custom-value/>
    </splunk-control-group>
Tags (1)

chrisyounger
SplunkTrust
SplunkTrust

Hi @asemle
This appears to be a bug and not working in version 7.2.1 and maybe other versions. What version are you running?

If you look at the bottom of this page: https://docs.splunk.com/Documentation/Splunk/latest/AdvancedDev/CustomAlertUI you can see others have reported it too. You should raise a support ticket to see if support can give you a workaround. I can't find any mention of this bug on the known issues page so it must be pretty new.

All the best.

0 Karma

asemle
Explorer

I tried but it looks like I don't have a support contract.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...