I have a form that has a submit button I would like to open a panel with the form inputs after hitting the submit button. I thought is would be as simple as setting a token for the panel with $submitted:$ But for some reason this does not work. Here is the code with $submitted:StarId$ being the token I am trying to use <form script="table_icons_rangemap.js,tokenlinks.js" stylesheet="table_decorations.css,no_resize.css"> <label>TASMAN eTeam Dashboard</label> <description>TASMAN eTeam Dashboard</description> <searchTemplate> <![CDATA[ index=starx* (sourcetype=enable-integration OR sourcetype=cavi) NOT (WARN) (clOrdId="*" OR priceId="*" OR ExecID="*" OR execID="*" OR client_order_id="*" OR starxchange_id="*" OR "11=" OR orderId="*" OR processing="*") | rename execID as ExecID | rex field=_raw "11=(?<clOrdId>\w{3}\d{6}-\d{10})" | rex field=_raw "11=(?<clOrdId>\d{8})" | eval clOrdId=if(isnull(clOrdId),if(isnotnull(orderId),orderId,clOrdId),clOrdId) | `extractMurex` | rex field=_raw "98=(?<secondaryOrderId>\w{3}\d{6}-\d{10}-\w{1}\d{1})" | search NOT (secondaryOrderId="*-m*" OR secondaryOrderId="*-s2*") | fillnull value="" clOrdId | eval clOrdId=if(isnotnull(murexId),null(),clOrdId) | eval clOrdId=if(isnull(clOrdId),if(isnull(ExecID),if(isnotnull(orderId),orderId,clOrdId),null()),clOrdId) | eval orderId=if(isnotnull(clOrdId),if(isnotnull(secondaryOrderId),null(),orderId),orderId) | eval timeStamp=_time | transaction secondaryOrderId,orderId | fillnull value="" price,symbol,legalEntityName,legalEntityId,blotterEntryType,accountId,bookedBy,productType | lookup starx-legalEntities.csv legalEntityWid as legalEntityId OUTPUT legalEntityName | search (clOrdId="$StarId$" AND clOrdId="$Region$*" NOT secondaryOrderId="*-m*") | search price="$price$" symbol="$ccypair$" symbol="*$ccypairFree$*" legalEntityName="*$legalEntityName$*" legalEntityId="*$legalEntityId$*" blotterEntryType="*$blotterEntryType$*" accountId="*$account$*" bookedBy="*$bookedBy$*" productType="$productType$". | `extractStatus` | search status="$Status$" | `formatNumber(orderQty)` | eval latest=mvindex(timeStamp,-1) | eval latest=latest+3600 | eval earliest=mvindex(timeStamp,0) | eval earliest=earliest-60 | table clOrdId,blotterEntryType, legalEntityName, legalEntityId, accountId, symbol, productType, side,orderQty, currency, murexId, price, bookedBy, transactTime, settlementDate, status, duration, eventcount,earliest,latest | `renameFields` | `timeConvert(transactTime)` ]]> </searchTemplate> <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="Region"> <label>Region</label> <default>*</default> <choice value="*">Any</choice> <choice value="LON">London</choice> <choice value="SYD">Sydney</choice> <choice value="NYK">New York</choice> </input> <input type="text" token="StarId"> <label>Star ID</label> <default>*</default> </input> <input type="dropdown" token="blotterEntryType"> <label>Trade Type</label> <default>*</default> <choice value="*">Any</choice> <populatingSearch fieldForValue="blotterEntryType" fieldForLabel="blotterEntryType">index=starx sourcetype=enable-integration INFO blotterEntryType earliest=-4d | dedup blotterEntryType | sort by blotterEntryType | table blotterEntryType</populatingSearch> </input> <input type="text" token="legalEntityName"> <label>Legal Entity</label> <default>*</default> </input> <input type="text" token="legalEntityId"> <label>Legal Entity WID</label> <default>*</default> </input> <input type="text" token="account"> <label>Account WID</label> <default>*</default> </input> <input type="dropdown" token="ccypair"> <label>Currency Pair</label> <default>*</default> <choice value="*">Any</choice> <populatingSearch earliest="-4d@d" latest="now" fieldForLabel="Symbols" fieldForValue="currencypair">index=starx sourcetype=enable-integration | rex field=_raw "55=(?P<currencypair>\w+/\w+)" | dedup currencypair | sort currencypair | table currencypair</populatingSearch> </input> <input type="text" token="ccypairFree"> <label>Currency Pair (freeform)</label> <default>*</default> </input> <input type="dropdown" token="productType"> <label>Product Type</label> <default>*</default> <choice value="*">Any</choice> <populatingSearch fieldForLabel="Product Type" fieldForValue="productType">index=starx sourcetype=enable-integration INFO earliest=-4d productType | dedup productType| table productType</populatingSearch> </input> <input type="text" token="price"> <label>All-in Rate</label> <default>*</default> </input> <input type="text" token="bookedBy"> <label>Booked By</label> <default>*</default> </input> <input type="dropdown" token="Status"> <default>*</default> <choice value="*">Any</choice> <populatingSearch earliest="-4d" latest="now" fieldForLabel="status" fieldForValue="status">index=starx sourcetype=enable-integration INFO earliest=-4d | `extractStatus` | dedup status | table status</populatingSearch> </input> <input type="time"> <label>Search Period</label> <default> <earliestTime>@d</earliestTime> <latestTime>now</latestTime> </default> </input> </fieldset> <row> <panel depends="$submitted:StarId$"> <table> <title>Trade detail</title> <option name="showPager">true</option> <option name="count">10</option> <drilldown target="_trade"> <link> <![CDATA[ /app/eproduct/order_detail?earliest=$row.earliest$&latest=$row.latest$&clOrdId=$row.StarID$ ]]> </link> </drilldown> </table> <html> <button class="btn" data-unset-token="submitted:StarId">Close Trade Detail</button> </html> </panel> </row> ... View more

I have removed a sourcetype from my inputs.conf [monitor:///data01/.../current/logs/*.log] disabled = 0 sourcetype = log4j index = oms blacklist = gc\.(web|Node)[1-4]\.log It's been changed to split up the sourcetypes as follows [monitor:///data01/.../current/logs/fxoms*.log] disabled = 0 sourcetype = oms index = oms blacklist = gc\.(web|Node)[1-4]\.log [monitor:///data01/.../current/logs/fxlm*.log] disabled = 0 sourcetype = lm index = oms blacklist = gc\.(web|Node)[1-4]\.log [monitor:///data01/.../current/logs/tomcat*.log] disabled = 0 sourcetype = tomcat index = oms blacklist = gc\.(web|Node)[1-4]\.log [monitor:///data01/.../current/logs/*gc*.log] disabled = 0 sourcetype = sun_jvm crcSalt = <SOURCE> index = jmx [monitor:///data01/app/oms-holiday-adapter/current/logs/*.log] disabled = 0 sourcetype = oms index = oms [monitor:///data01/app/oms-client-account-adapter/current/logs/*.log] disabled = 0 sourcetype = oms index = oms I have restarted the forwarder and can now see the 3 new sourcetypes ln oms and tomcat, but I am still getting a couple of log files being ingested with the sourcetype log4j. There is no longer any reference to log4j in the config on the host How is it doing this? ... View more

I am trying to pass the numeric result of a subsearch to the head command with no success, can anyone see what I am doing wrong? The following query returns a count of 3 index=starx error | fieldformat count=count/2 | stats count I want to use that query as a subsearch result for the head command like this index=starx error | head [ search index=starx error | fieldformat count=count/2 | stats count ] But get no result found ... View more