Hi, I've been searching online and trying to find an answer for this. Essentially it's building a dashboard/app page with predefined searches for people to use. What I am trying to implement is a drop down choice at the beginning to select the search you wish to run. Then after that there is two fields for difference resource id's. The first field is just an id and will be the same for all searches, user_id will work for this example. Then the second field would need to change depending on the choice of search. For example: Select search from dropdown (all user actions from an IP) This would have the first field as user_id and need to have the second field as ip= Select search from dropdown (all user actions on a certain index) This would have the first field as user_id and need to have the second field as index= That way when someone opens it up they can select the search they want to run from the drop down, then enter the user_id, and finally enter the last field which would change depending on the search chosen, after they hit submit the entered values would be assigned to their field names and added to the search which will be stored in the drop down (trimmed down extract of what it looks like atm) <label>user + ip</label> <searchTemplate>$searchstring$ user_id=$user_id$ (changable_field_name=user_submitted_value)</searchTemplate> <fieldset> <input type="dropdown" token="searchstring"> <label>Search</label> <choice value='SEARCH STRING WOULD BE INCLUDED HERE ASIDE FROM THE USER_ID AND ADDITIONAL FIELD NAME'>user actions from a specific ip</choice> <choice value='SEARCH STRING WOULD BE INCLUDED HERE ASIDE FROM THE USER_ID AND ADDITIONAL FIELD NAME'>user actions on a specific index</choice> <input type="text" token="user_id"> <label>user_id</label> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="text" token="ip"> <label>ip</label> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> </input> <input type="text" token="index"> <label>index</label> <default>*</default> <prefix>"</prefix> <suffix>"</suffix> </input> So while I know this will populate the entered user_id from the field into the search string ( user_id=$user_id$ ), I am at a loss of how to have the second field name update from the drop down and then apply into the searchTemplate along with the provided value where it says (changable_field_name=user_submitted_value) above. Thanks in advance for any help ... View more

Hey there, I've been having a look around on here, and through Google, but so far coming I'm up blank. I'm looking for a way to basically change how an ID is displayed in a table. Say I run a search like this: sourcetype=testsource | table _time, , sourcetype, id and I get a table back like _time sourcetype id 12:00 testsource 123 So while the id value is indeed 123, I would like to have it — depending on the ID —display with a URL or filepath. For example: _time sourcetype id 12:00 testsource test.com/123 Is this possible without diving into drill down and dashboards (http://docs.splunk.com/Documentation/Splunk/7.1.2/Viz/DrilldownIntro), it's not going to be a regular requirement in a search so something I can throw in the query on the fly would be ideal. TIA! ... View more