XML form is not working in Splunk 6 but same code is working in Splunk 5. Below is the code please help:
<form>
<label>Search</label>
<searchTemplate>search query | search field1 = $name$ </searchTemplate>
<fieldset autoRun="true" submitButton="true">
<input type="text" token="name">
<label>Search</label>
<default></default>
<suffix>*</suffix>
</input>
</fieldset>
<row>
<table>
<title>overview</title>
<earliestTime>@d</earliestTime>
<latestTime>now</latestTime>
<option name="showPager">true</option>
<option name="count">20</option>
<option name="displayRowNumbers">true</option>
</table>
</row>
</form>
Thanks in advance
Harshal
Try adding a value between the <default>
tags. I don't know your real search string so I had to come up with my own. This form search works in Splunk 6:
<form>
<label>Search</label>
<searchTemplate>sourcetype="syslog" | search COMMAND = $name$ </searchTemplate>
<fieldset autoRun="true" submitButton="true">
<input type="text" token="name">
<label>Search</label>
<default>./</default>
<suffix>*</suffix>
</input>
</fieldset>
<row>
<table>
<title>overview</title>
<earliestTime>@d</earliestTime>
<latestTime>now</latestTime>
<option name="showPager">true</option>
<option name="count">20</option>
<option name="displayRowNumbers">true</option>
</table>
</row>
</form>
The only changes I made were the search string (so there would be results to test) and the addition of a default value. If you don't need a default value, you should remove the default tags entirely. The above form works just fine without a default (it just waits for the user to enter something in the input box and click Search
).
I have fixed it the reason in my case is SOURCE contains "$" symbol and after putting escape character it is working fine.