Splunk Search

Drop down not working with Metadata query.

sanju005ind
Communicator

This is the View which I created with a form which contains a dropdown to list department names.All the hosts are tagged with the Dept Names eg. ACC,CORP,FIN.There are about 1500 hosts.

<form>
    <label>Log Sources that are reporting</label>


<searchTemplate>| metadata type=hosts   | fields + host, firstTime, lastTime,totalCount   | convert ctime(firstTime)   | convert ctime(lastTime)  | sort - host | TAGS | search tag::host=$bussiness$ </searchTemplate>
   <earliestTime>-7d</earliestTime>

    <fieldset>
        <input type="dropdown" token="bussiness">
            <label>Select Business</label>
            <choice value="CORP">Corporate</choice>
      <choice value="ACC">Accounts</choice>
      <choice value="Fin">Finance</choice>
        </input>
    </fieldset>

    <row>
        <!-- output the results as a 50 row events table -->
        <table>

            <title>Matching events</title>
            <option name="count">50</option>
        </table>
    </row>
</form>

After I submit the form after selecting CORP from the dropdown option I do not get any results.However when I click on the view results button I see that the query has "None" inserted in it.

| metadata type=hosts   | fields + host, firstTime, lastTime,totalCount   | convert ctime(firstTime)   | convert ctime(lastTime)  | sort - host | TAGS None | search tag::host=CORP

Could you someone help me out with this one as this is urgent?

Tags (2)
0 Karma
1 Solution

thall79
Communicator

In your search | sort - host | TAGS | search tag::host=$bussiness$ have you tried adding the word host to TAGS?

| sort - host | tags host | search tag::host=$bussiness$

Travis.

View solution in original post

thall79
Communicator

In your search | sort - host | TAGS | search tag::host=$bussiness$ have you tried adding the word host to TAGS?

| sort - host | tags host | search tag::host=$bussiness$

Travis.

sanju005ind
Communicator

Thanks.That worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...