Splunk Search

setting default with seed not working for text input field

black123
New Member

REFs:

  1. http://docs.splunk.com/Documentation/Splunk/6.0.3/Viz/PanelreferenceforSimplifiedXML#Form_inputs
  2. http://answers.splunk.com/answers/28633/current-user-in-search

input type="text"
Appears to support with "The initial value of the input element. Can be specified by a value returned from a populating search.".

I want a text field that users can input a "username" into. (And have it default to the current user.) However, I am unable to get it to work. Here is what I am doing.
Note: If I do not use the populatingSearch wrapper around the CDATA block then I see the literal CDATA string in the dashboard.
Note: If I drop the seed element then I see nothing.

<input type="text" token="MyLookupUser" searchWhenChanged="true">
  <label>User to Lookup</label>
  <seed><populatingSearch><![CDATA[ | rest /services/authentication/current-context/context | fields + username | dedup username | search username !=splunk-system-user | rename username as user ]]></populatingSearch></seed>
</input>

What am I doing wrong?
What else do you need to know to help me with this "feature"??

0 Karma

snoobzilla
Builder

See this... I am already in sideview, so I expect it to work...

[http://answers.splunk.com/answers/84672/how-to-populate-form-input-field-with-result-from-query][1]

0 Karma

black123
New Member

Hum: "use Sideview" ( REF: http://sideviewapps.com/apps/sideview-utils ) UI modules "bolt on" that has a bit odd of a license. (REF: http://sideviewapps.com/apps/sideview-utils/download-full-version-internal-use/ ) To bad it is not LGPL still. 😞

No thanks.

Besides the main issue is that the plunk docs suggest that what I am trying to do should work.

I suspect a bug exists. Either in the documentation, or in the product. What I want is one of the two to change. Yes, I want the functionality, but I can live with an answer of "You can not do that." too. vgenovese is researching. I can wait.

0 Karma

cphair
Builder

@black123, did you get an answer from Splunk about this?

0 Karma

black123
New Member

Nope. Still waiting for a solution. ( Well, I have mostly given up on building a splunk based UI to work the way I want it to at this point. )

0 Karma

snoobzilla
Builder

Having same need to set default value of text input field. Anyone know how to do this in sideview?

0 Karma

black123
New Member

RE your point #1:
See the table " child elements" in the URL that we both posted.

Specifically:
"
element:

Type: Attribute value

Description: The initial value of the input element. Can be specified by a value returned from a populating search.
"

So, how do the docs say that a Text element does not support a populating search?

They appear to say that a text input supports a seed element (0..1) which in turn supports a populating search.

To be fair my search should always return one value for the seed.

0 Karma

melting
Splunk Employee
Splunk Employee

A couple of things

  1. Text inputs do not support populating search: http://docs.splunk.com/Documentation/Splunk/6.0.3/Viz/PanelreferenceforSimplifiedXML#input_.28text.2...
  2. seed supports text or tokens, not search

I don't think you can do this with simplexml only. You could write a javascript extension to help you, would you be open to using javascript?

vgenovese
Splunk Employee
Splunk Employee

is for using a search to populate choices for a dropdown or radio inputs.

For a text input, you can set the value with default, but I'm not sure how to set the value of default dynamically. I will research and respond.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...