creating form including drop down menus

[gnovak]

Hello!

I've been going through some of the posts here in Answers and have been trying different things but still haven't quite created the form view I'm looking for. I'm a bit of a noob to forms so i apologize if my code is a bit blah.

So here is the situation....

I am trying to create a view that includes a form. On the form there would be a drop down menu where you could choose the registry of your choice that will run a search on that registry. These registries would be INFO, ASIA and ORG.

I also have a text box created next to the drop down menu where if you wanted to, you could also type in a specific customer account for say, info asia or org, and locate it either before the initial search is complete, or after it is complete.

There is also a drop down menu for the time range you want to search by.

The problem I am having is connecting the correct search to run when selecting things from the drop down menu.

As a side note, for INFO, ASIA and ORG I have saved searches that will produce the results I am looking for. I have tried using savedsearch when creating the XML but haven't had a ton of luck w/ that.

The saved search names are: balance_email_sent_registrars_asia, balance_email_sent_registrars_info, balance_email_sent_registrars_org.

I've also tried NOT using savedsearch and still can't seem to get it the way I want. Below is the code I currently have. And again, I'm a bit new to this and have just been taking reference points from UI examples, entries on answers.splunk.com and other tidbits from documentation so if something is out of place or does not belong, let me know!

    <form>
  <label>Balance Email Summary2</label>
  <searchTemplate>savedsearch="balance_email_sent_registrars_asia" | search $Registry$ </searchTemplate> 
<fieldset>
      <input type="dropdown" token="Registry">
        <label>Select Registry</label>
    <choice value="INFO">INFO</choice>
    <choice value="ASIA">ASIA</choice>
    <choice value="ORG">ORG</choice>
      </input>
      <input type="text" token="Registrar">
        <label>Registrar</label>
      </input>
      <input type="time">
        <default>Last 30 days</default>
     </input>
  </fieldset>
<row>
      <table>
        <option name="showPager">true</option>
        <option name="count">20</option>
      </table>
  </row>
</form>

IN the example, I only have savedsearch "balance_email_sent_registrars_asia" | search $Registry$ because I am not sure how to proceed. Can i have multiple saved searches point to the options i have put in the drop down menu? I want to be able to select either asia, info or org from the drop down, select a time range, and when i click search it should access the correct saved search that I stated above and produce the results I'm asking for....help? I'm kind of lost at this point how to get the results I want but I keep playing!

[NOUMSSI]

Hi,
Here is the correct source code:

  <form>
  <label>Balance Email Summary2</label>
<fieldset autoRun="true" submitButton="false">
      <input type="dropdown" token="Registry" searchWhenChanged="true">
        <label>Select Registry</label>
    <choice value="INFO">INFO</choice>
    <choice value="ASIA">ASIA</choice>
    <choice value="ORG">ORG</choice>
      </input>
      <input type="text" token="Registrar" searchWhenChanged="true">
        <label>Registrar</label>
      </input>
      <input type="time" token="time_range" searchWhenChanged="true">
        <default>
           <earliestTime>-30d@d</earliestTime>
          <latestTime>now</latestTime>
        </default>
     </input>
  </fieldset>
<row>
      <table>
        <searchTemplate>savedsearch="balance_email_sent"| search $Registry$ $Registrar$ </searchTemplate> 
        <earliestTime>$time_range.earliest$</earliestTime>
        <latestTime>$time_range.latest$</latestTime>
      </table>
  </row>
</form>

Note that in this code, if you absolutely want to use a saved search, you most create a global saved search (it means that the search must not be spécified to a particular registry or registrar). Here the global search is called balance_email_sent

There is another way; instead of using

<searchTemplate>savedsearch="balance_email_sent"| search $Registry$ $Registrar$ </searchTemplate>

You can use this for example

<searchString>index=* $Registry$ $Registrar$ | ... </searchString>

[gnovak]

Thanks Nick! I was doing it backwards with the IOIOIO thingy....code is now there...

[sideview]

To put code into a question you can either enclose it in backticks, or for larger blocks you can just indent the whole thing with 4 spaces. Or you can select the code in the textarea and then click the funky "IOIOIO" icon which will indent it for you.