Splunk Search

populatingSearch not working -- Search works as standalone search

neiljpeterson
Communicator

Very simple search string which works fine in free search. Similar searches like this work fine for other fields. The fields do not populate. The search is definitely completing, I even tried to limit it to a shorter time with to no effect.

What am I missing here?

   <form>
      <label>Server Selector</label>
      <description>Displaying all active application servers with logged events going back 30 days</description>
      <!-- Do not need a Search Button. Inputs search when changed -->
      <fieldset autoRun="true" submitButton="false">
        <!-- Specify search when changed for the inputs -->
        <input type="radio" token="app_server" searchWhenChanged="true">
          <label>Select a Server:</label>
          <choice value="something">something</choice>
          <populatingSearch fieldForValue="app_server" fieldForLabel="app_server" earliest="-30d" latest="now">
            <![CDATA[host=* | stats dc(host) by host]]>
          </populatingSearch>
        </input>
      </fieldset>
    </form>
Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your search yields two fields, host and dc(host). However, your radio input is looking for a field called app_server.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your search yields two fields, host and dc(host). However, your radio input is looking for a field called app_server.

neiljpeterson
Communicator

Doh! Thank you. Works perfectly now!

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...