Basic problem is that I need to pull out valid reporting dates for each account.
If you can imagine a text box, and a drop-down.. The text box is looking for an account number. I then want splunk to run the populating search for the dropdown to get the valid reporting dates, using the account number entered in the text box. Is this possible?
Hello,
If you are using splunk 6 or more, It's possible. You can add the token for the tex box to populating search for the dropdown. you can find the exemple below which have dropdown populated sourcetype with values from a search that uses a token from a previous text box for index:
<form>
<label>Dashboard_Token</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="index" searchWhenChanged="true">
<label>entrer index</label>
</input>
<input type="dropdown" token="Sourcetype" searchWhenChanged="true">
<default>*</default>
<populatingSearch earliest="0" latest="" fieldForLabel="sourcetype" fieldForValue="sourcetype">index=$index$ | stats count by sourcetype</populatingSearch>
</input>
</fieldset>
<row>
<panel>
<table>
<searchString>index=$index$ OR index=_$index$ | table index sourcetype</searchString>
<earliestTime/>
<latestTime/>
</table>
</panel>
</row>
</form>
You can copy and create a dashboard in the search app with a simple xml above to see more.
regard,
Patient