Splunk Search

How to get two form inputs to run separate searches, each with their own submit button in a Simple XML dashboard?

chadman
Path Finder

I'm trying to get 2 separate searches to work on a simple xml dashboard. I would like to have 2 input boxes and 2 search buttons. I tried this and get 2 input boxes, but only have one search button.

<form>
  <label>Workstation NEW Search</label>

  <fieldset>


       <input type="text" token="desktop">
       <label>Serial Number</label>
       <suffix>*</suffix>
                 </input>
  <input type="time">
      <default>Last 24 hours</default>
  </input>

<input type="text" token="userid">
       <label>User Name</label>
       <suffix>*</suffix>
   </input>
  <input type="time">
      <default>Last 24 hours</default>
  </input>
</fieldset>

How can I get 2 search buttons? So if I click one, it should only run search in my first row. If I enter text in the second textbox, it should run a search in the second row.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I think you can do this in two ways. First - ignore the submit buttons, and change the inputs to "Search when Changed". You can do this in the "Edit Panels" and edit the inputs (Splunk 6.2).

OR

You might be able to specify two fieldsets - note: I haven't tried it.

 <fieldset>
 <input type="text" token="desktop">
    <label>Serial Number</label>
    <suffix>*</suffix>
              </input>
<input type="time">
   <default>Last 24 hours</default>
</input>

</fieldset><fieldset>

<input type="text" token="userid">
    <label>User Name</label>
    <suffix>*</suffix>
    </input>
   <input type="time">
   <default>Last 24 hours</default>
   </input>
   </fieldset>
0 Karma

chadman
Path Finder

2 field sets does not work. I'm using version 5 and don't see that option and not sure how to do your first option. Maybe that does not work in my version.

I did find a post with this

Example

This looks close, but it has the 2 searches in the first row. I was hoping to do something similar, but have row one do the first search and the last rows do the second. Any ideas how to make that work?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...