Dashboards & Visualizations

Issue with simple XML dropdown search

MHibbin
Influencer

SplunkBase,

I have a query about dropdown searches using the simple XML editor in Splunk. I fear I am missing something blindingly obvious, but I just can't seem to see it.

I started by creating a view which includes a search (text input) for a user and displays a table of results, which works. However when I change the input to dropdown, and add the populating search. I receive the following error...

SearchLister module SearchSelectLister_0_1_0 was not given a search or a saved search name to power itself and thus cannot render any data.

Below is the XML I have edited...

<form>
  <label>User Search (DropDown Selecter)</label>
  <searchTemplate>sourcetype=logs user=$username$ | table _time user message</searchTemplate>

  <fieldset>
    <input type="dropdown" token="username" />
      <label>Select user name</label>
      <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
      <default>*</default>
  </fieldset>

  <row>
    <table>
      <title>User message activity (Last 100)</title>
        <option name="showPager">true</option>
        <option name="count">100</option>
    </table>
  </row>

</form>

Any assistance would be appreciated and many thanks in advance.

Regards,

MHibbin

0 Karma
1 Solution

Ayn
Legend

You're closing the dropdown <input> tag immediately but you should be keeping it open and run your populatingSearch inside the input section. So:

<input type="dropdown" token="username">
  <label>Select user name</label>
  <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
  <default>*</default>
</input>

View solution in original post

Ayn
Legend

You're closing the dropdown <input> tag immediately but you should be keeping it open and run your populatingSearch inside the input section. So:

<input type="dropdown" token="username">
  <label>Select user name</label>
  <populatingSearch fieldForValue="username" fieldForLabel="username"><![CDATA[sourcetype=logs | rex field=user "(?P<username>\w+)" | stats count by username]]></populatingSearch>
  <default>*</default>
</input>

Ayn
Legend

That is possible. It might be better to discuss that in the thread you created yourself though... 🙂

0 Karma

monicato
Path Finder

@MHibbin, I'm not quite sure, but my populating search is basically searching through millions of logs to find the name of different products. And the complete search returns about 150 different product names. Is there any way to have a saved search and then i could extract the saved search for all the products names instead of having to go through all the logs each time my view is loaded?

0 Karma

MHibbin
Influencer

@monicato, No I never had those issues, what is the search you are using? ... how long does it take running in flashtimeline?

0 Karma

monicato
Path Finder

On a different note, @MHibbin, is your populating search taking an incredibly long time to load for the dropdown? I have a problem where my populating search takes 30min+ to complete. The only solution I could think of was listing static options for my dropdown... any ideas to speed the populating search up? ~thanks!

0 Karma

MHibbin
Influencer

Thanks Ayn, I knew it would be blindingly obvious... I was determined in thinking it was the search string, so didn't look else where!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...