XML Form differences following Splunk 6 upgrade

[pkeller]

This may be a long winded question ...
After upgrading one of our search head pools from 4.3.6 to Splunk 6.0 I'm finding that I'm having to make XML changes to many of the forms that worked fine in 4.3.6 ... This could be due to my having written poorly formatted code in the earlier version, or it could be due to a change in functionality ...

example: ... the block contains this ...
|inputlookup oradb.csv | table host,SID,RAC_INSTANCE,LIFECYCLE | where (host LIKE "$s_hostname$") AND (SID LIKE "$s_instance$")

The XML that applies to this template looked like this:

  </fieldset>
   <input type="text" token="s_hostname">
      <label>Enter a hostname or pattern</label>
      <default></default>
       <suffix>%</suffix>
    </input>
    </fieldset>
    <fieldset>
    <input type="text" token="s_instance">
      <label>DB Instance Name</label>
      <default></default>
      <suffix>%</suffix>
    </input>
   </fieldset>

Now in order to get this to work ... I had to make the following changes:
{code}

  </fieldset>
   <input type="text" token="s_hostname">
      <label>Enter a hostname or pattern</label>
      <! I had to add the '%' in the default block ... which worked without it in 4.3.6 -->
      <default>%</default>
       <suffix>%</suffix>
    </input>
    <! I removed the end and beginning fieldset blocks -->
    <input type="text" token="s_instance">
      <label>DB Instance Name</label>
      <! I had to add the '%' in the default block ... which worked without it in 4.3.6 -->
      <default>%</default>
      <suffix>%</suffix>
    </input>
   </fieldset>

Also ... in Splunk 6, the default values are visible in the input boxes of the form ... I assume that is now expected behavior ... If anyone has a better suggestion for formatting this XML ... I'd welcome it.

[nfilippi_splunk]

Correct, you should include all of your inputs within a single fieldset.

Regarding your use of default, what are you trying to do here? With your current configuration, the user will see "%" within the text input form when they load the page, and if they just click search, the token value will be "%%". Is that expected?

Some questions here:

• What do you want users to see when they first load the page (within the form inputs?
• If the user enters something like "my_hostx", what do you want the resulting token value to be? (%my_hostx%, my_hostx%)
• If the user leaves the form input blank (deletes the populated value), what do you want the token value to be? (this will determine if you should use default or seed)

[nfilippi_splunk]

So in this case, you probably don't need any default here as the suffix will do what you need.

[pkeller]

Thanks for your quick answer ...

1. First thing they see should be a page with two form inputs the first for a hostname the second for a database name ... They should be able to enter one or both.
2. If the user enters my_hostx ... the token should be my_hostx%
3. If the form input is blank ... the token should match everything .. so I assume '%'

So, the reason I used a default of '%' and a suffix of '%' was to give the user the option of entering a pattern ( which would be appended with the wildcard ... ) or nothing so that the search would be the wildcard on its own.

Cheers,
Paul