Splunk Search

populatingSearch not working -- Search works as standalone search

neiljpeterson
Communicator

Very simple search string which works fine in free search. Similar searches like this work fine for other fields. The fields do not populate. The search is definitely completing, I even tried to limit it to a shorter time with to no effect.

What am I missing here?

   <form>
      <label>Server Selector</label>
      <description>Displaying all active application servers with logged events going back 30 days</description>
      <!-- Do not need a Search Button. Inputs search when changed -->
      <fieldset autoRun="true" submitButton="false">
        <!-- Specify search when changed for the inputs -->
        <input type="radio" token="app_server" searchWhenChanged="true">
          <label>Select a Server:</label>
          <choice value="something">something</choice>
          <populatingSearch fieldForValue="app_server" fieldForLabel="app_server" earliest="-30d" latest="now">
            <![CDATA[host=* | stats dc(host) by host]]>
          </populatingSearch>
        </input>
      </fieldset>
    </form>
Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your search yields two fields, host and dc(host). However, your radio input is looking for a field called app_server.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your search yields two fields, host and dc(host). However, your radio input is looking for a field called app_server.

neiljpeterson
Communicator

Doh! Thank you. Works perfectly now!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...