Dashboards & Visualizations

XML form not working in Splunk 6.0.2

d12harshal
Path Finder

XML form is not working in Splunk 6 but same code is working in Splunk 5. Below is the code please help:

<form>
  <label>Search</label>

     <searchTemplate>search query | search field1 = $name$  </searchTemplate>

   <fieldset autoRun="true" submitButton="true">       
       <input type="text" token="name">         
        <label>Search</label>
        <default></default>
        <suffix>*</suffix>
       </input> 
     </fieldset>
    <row>
     <table> 
       <title>overview</title>
       <earliestTime>@d</earliestTime>
      <latestTime>now</latestTime>
        <option name="showPager">true</option>
        <option name="count">20</option>
        <option name="displayRowNumbers">true</option>
     </table>            
   </row>
</form>

Thanks in advance
Harshal

0 Karma

gauldridge
Path Finder

Try adding a value between the <default> tags. I don't know your real search string so I had to come up with my own. This form search works in Splunk 6:

<form>
    <label>Search</label>

    <searchTemplate>sourcetype="syslog" | search COMMAND = $name$  </searchTemplate>

    <fieldset autoRun="true" submitButton="true">       
        <input type="text" token="name">         
            <label>Search</label>
            <default>./</default>
            <suffix>*</suffix>
        </input> 
    </fieldset>
    <row>
        <table> 
            <title>overview</title>
            <earliestTime>@d</earliestTime>
            <latestTime>now</latestTime>
            <option name="showPager">true</option>
            <option name="count">20</option>
            <option name="displayRowNumbers">true</option>
        </table>            
    </row>
</form>

The only changes I made were the search string (so there would be results to test) and the addition of a default value. If you don't need a default value, you should remove the default tags entirely. The above form works just fine without a default (it just waits for the user to enter something in the input box and click Search).

0 Karma

d12harshal
Path Finder

I have fixed it the reason in my case is SOURCE contains "$" symbol and after putting escape character it is working fine.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...