I am building a dashboard where a user supplies a single request GUID using a text input. We use the request GUID to determine (among other things) which endpoint on our platform was hit for that request.
I want to set a form variable to have the value of the endpoint that was hit. So, I want to run a search for the GUID, return the endpoint, and store that for later use. Ideally the XML would look something like this:
<fieldset submitButton="true">
<input type="text" token="formRequestGuid" searchWhenChanged="true">
<label>Request GUID:</label>
<change>
<set token="formEndPoint">[search index=requestdata requestGuid="$formRequestGuid$" | head 1 | return $endPoint]</set>
</change>
</input>
</fieldset>
...
<row>
<panel>
<title>Load Time for $formEndPoint$</title>
...
</panel>
</row>
Obviously this doesn't work for a few reasons, but hopefully the theoretical XML gets across what I want to do. Right now I see a few issues with this XML:
Does anyone know of a good way to workaround these issues?
Hi bruceclarke, you might be able to get close by using a populating search filling a dropdown with available guids : see populatingSearch at http://docs.splunk.com/Documentation/Splunk/6.0.4/Viz/PanelreferenceforSimplifiedXML#Form_inputs
Let me know how this works out.
Unfortunately each GUID corresponds to a specific request in our product. So there can be millions of GUIDs that we would need to search. Given this constraint, we feel we need to use a text input for the GUID.