hmm, I do want the different values, but now it looks like the error belongs to the flow (sourcetype) "action" While actually its in flow "message" Id flow level count 123456 action error 2 message exe ... View more

let me try to rephrase. The result of the search contains both sourcetypes. In one row the error is presented next to the sourcetype which does not contain the error. Maybe splunk does an order by alphabet? ... View more

Great, it works. Now trying to understand. First you select both indexes/sourcetypes? Then a subselect (between brackets) to select the errors? The stats at the end uses fields from both searches? I noticed one strang thing, when i look at the output the fieldvalues don's align with the row. For example, one result is like this: Id flow level count 123456 action error 2 message exe In fact the 'error' belongs to 'message' I hope you understand what I mean ... View more

sourcetype1=Id, loglevel (if its an error, loglevel=error) description (of the error) sourcetype2=Id, action, description (of the action) If the action from sourcetype 2 results in an error, it results in a event in sourcetype 1. Where the id is equal ... View more

the error is not present in both sourcetypes only in one. One sourcetype contains actions, the other contains errors (if there are any) when the action cant be executed. The Id is unique in both ... View more

maybe i was not complete in my question, but the field with the error is only present in one of the sourcetypes, so if i filter on the value of the error i dont get both the sourcetypes and their data ... View more

maybe i was not complete in my question, but the field with the error is only present in one of the sourcetypes, so if i filter on the value of the error i dont get both the sourcetypes and their data ... View more

maybe i was not complete in my question, but the field with the error is only present in one of the sourcetypes, so if i filter on the value of the error i dont get both the sourcetypes and their data ... View more

That's why I am lost, none of the above is the case. Then again, whether someone has changed them is not something I can check ... View more

Hi @nickhillscpl, thanks for your response. I have fieldextractions throug the 'field extractor' under 'settings'. Are these 'search time extractions' ? For your other comments i wil contact the admin because this is not my cup of tea, i was only wondering. ... View more

@niketnilay, I just noticed by the way that when using Firefox the ENTER also acts like the TAB and the 'cross' to clear the text misses. Did you know that? ... View more

@niketnilay, thank you very much for your help and time (and patience). For now it works and the 'searchwhenchanged' is clear now. ... View more

Hi, 'Do you really want this overhead just not to tab out of the text box?' No, but I thought that that was the purpose of the 'searchwhenchanged' . Now I understand that if the value is 'false' that there will be no new search executed of I enter a searchword for the second time. Maybe I just keep misunderstanding you, but I have a panel (no HTML) that acts like the following: - Opening the dashboard-enter a value in textblock -TAB. When there is a result , then the panel opens (with the results) . When there is no result (matching the searchvalue) the panel also opens, but the message 'No results found' is showing. When I clear the textblock and TAB, then the panel does not open. This behaviour is the same when I use tokField2 or Field2. That is the main issue I don't understand. Because you explained that there is a difference between the two fields ... View more

@niketnilay I can't let it go 🙂 . -"I would request you to go through the Splunk Docs link I previously shared: http://docs.splunk.com/Documentation/Splunk/latest/Viz/EventHandlerReference#Event_handler_element" . I will do this. How does Splunk know that 'field2' is the same as 'tokField2' ? The thing I still don't understand is that wether I use field2 or tokField2 I don't see any difference in the behaviour. This is also the case with 'searchWhenChanged' , it does not matter if the value is true or false, you always have to 'TAB' before its executes a search. ... View more

@niketnilay, to prevent wasting your time. With the code I posted last it does what I need. I can search and the panel comes up after I 'TAB' . So lets leave it by that, I am afraid I am not gonna understand the difference between the field2 and tokfield2. The example 'Null result setter' I cannot find in the example app by the way. ... View more

In your previous answer you replied: 'Hence, form token field2 can not be used for your scenario' But why is the behavour the same with field2 and tokField2 ? ... View more

<form> <label>WlzServicesLog</label> <fieldset submitButton="false"> <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="field2" searchWhenChanged="true"> <label>Zoeken</label> <change> <condition match="isnull(value) OR value=&quot;&quot;"> <unset token="tokField2"></unset> </condition> <condition> <set token="tokField2">$value$</set> </condition> </change> </input> </fieldset> <row> <panel> <title>Berichtenverwerking</title> <event> <search> <query>index= xp* </query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="list.drilldown">none</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.sortDirection">asc</option> <option name="table.wrap">1</option> <option name="type">list</option> </event> </panel> </row> <row> <panel depends="$tokField2$">&gt;<title>test variabel</title> <table> <search> <query>index=XPO $field2$ |sort -Timestamp|table tijd severity message priority machine</query> <earliest>0</earliest> <latest></latest> </search> <option name="count">10</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <drilldown> <link target="_blank">search?q=index=XPO $field2$* |sort -Timestamp|table tijd severity message priority machine&amp;earliest=-24h@h&amp;latest=now</link> </drilldown> </table> </panel> </row> <row> <panel> <title>Meldingen</title> <table> <search> <query>index= xp* source="WlzServices.log" |sort -Timestamp|table tijd severity message priority machine</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </form> ... View more

just to be complete, her is my XML at this moment: labelname <input type="time" token="field1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="text" token="field2" searchWhenChanged="true"> <label>Zoeken</label> <change> <condition match="isnull(value) OR value=&quot;&quot;"> <unset token="tokField2"></unset> </condition> <condition> <set token="tokField2">$value$</set> </condition> </change> </input> <panel> <title>test</title> <event> <search> <query>index= xp*</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="list.drilldown">none</option> <option name="list.wrap">1</option> <option name="maxLines">5</option> <option name="raw.drilldown">full</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">0</option> <option name="table.drilldown">all</option> <option name="table.sortDirection">asc</option> <option name="table.wrap">1</option> <option name="type">list</option> </event> </panel> <panel depends="$tokField2$">&gt;<title>test variabel</title> <table> <search> <query>index=XPO $field2$ |sort -Timestamp|table tijd severity message priority machine</query> <earliest>0</earliest> <latest></latest> </search> <option name="count">10</option> <option name="drilldown">cell</option> <option name="refresh.display">progressbar</option> <drilldown> <link target="_blank">search?q=index=XPO $field2$* |sort -Timestamp|table tijd severity message priority machine&amp;earliest=-24h@h&amp;latest=now</link> </drilldown> </table> </panel> <panel> <title>Meldingen</title> <table> <search> <query>index= xp* source="WlzServices.log" |sort -Timestamp|table tijd severity message priority machine $field1.earliest$ $field1.latest$ 1 100 none cell progressbar ... View more

strange...I don't see a difference in the URL or behaviour wether I use 'tokField2' or 'field2' In both cases I see at the end of the URL: 'form.field1.earliest=0&form.field1.latest=&form.field2= ' And when I enter a text in the formvariable in both cases it shows: 'form.field1.earliest=0&form.field1.latest=&form.field2=searchword ' ... View more

I tried this, but when there is no submitbutton, the value isn't passed unless I use the 'TAB'button ... View more

tried to fit it in. put the 'submitButton' to True, otherwise there is no way to confirm the searchkeyword. Why is it that on one hand i use token 'field2' but you use 'tokField2' in the set/unset? I tried both but withe the same result actually ... View more