How to populate a radio button input with the unique values of a field?

[HattrickNZ]

I have the following radio button input that I would like to populate with the unique values of elementType

 <input type="radio" token="elementType">
        <label>Element Types</label>
        <choice value="*">All</choice>
        <populatingSearch fieldForValue="elementType" fieldForLabel="elementType">
          <![CDATA[index=core host="snzclakl598" | head 1000 | top elementType ]]>
        </populatingSearch>
        <default>*</default>
</input>

Do I need to use the token elementType further down in a search in a panel for the radio button input to work?
How do I set my to search for randomText* criteria? is this done in the

• * in the search in
• the radio button input in the

• search in the search string in the panel

  ... elementType=$elementType$ ... | timechart span=$timespan$ max(c100991388) by measObjLdn | eval threshold=80

[chimell]

Hi HattrickNZ
Try this xml code

<form>
<label>Form Input Example (Time)</label>
<description/>
     <input type="radio"  token="elementType">
    <label>Element Types</label>
    <choice value="*">All</choice>
    <populatingSearch fieldForValue="elementType" fieldForLabel="elementType">
    <![CDATA[index=core host="snzclakl598" | head 1000 | top elementType ]]>
    </populatingSearch>
    <default>*</default>
</input>

<input type="time"  token="timespan" searchWhenChanged="true">
<label>Select time range</label>
<default>
<earliestTime>-7d@h</earliestTime>
<latestTime>now</latestTime>
</default>
</input>
</fieldset>

<row>
<panel>
<chart>
<title> </title>
 <searchString>
index=core host="snzclakl598" elementType=$elementType$  ...... | timechart  span=$timespan$  max(c100991388) by measObjLdn  | eval  threshold=80
 </searchString>
<earliestTime>$timespan.earliest$</earliestTime>
<latestTime>$timespan.latest$</latestTime>
<option name="charting.chart">column</option>
</chart>
</panel>
</row>
</form>

[rsennett_splunk]

You want something like this:

<input type="radio" token="elementType" searchWhenChanged="true">
      <label>Element Types</label>
      <search>
        <query>index=core host="snzclakl598" | head 1000 | top elementType</query>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </search>
      <default>*</default>
      <fieldForLabel>elementType</fieldForLabel>
      <fieldForValue>elementType</fieldForValue>
      <prefix>elementType="</prefix>
      <suffix>"</suffix>
    </input>

Because I've used the prefix and suffix tags the search would be something like this:

... $elementType$  ... | timechart  span=$timespan$ max(c100991388) by measObjLdn  | eval  threshold=80

which would then translate to:

... elementType=value_from_radio_button  ... | timechart  span=$timespan$ max(c100991388) by measObjLdn  | eval  threshold=80

[HattrickNZ]

does token="elementType" map to this $elementType$ in the search. then why have a sepereate search in the radio button ``

What I want to do is fill the radio button with all the values of elementType

[rsennett_splunk]

the search is what does the filling. calling it elementType doesn't do anything but self annotate the code. I could have called it "mytoken" and used that populating search and it would still work... because the
elementType tells it which value from the populating search it should use to stuff the token... (the values for the elementType field...)

Try it.