I have a question on how to put multiple form searches on the same page that both feed a separate table. The first search is used in finding a specific I.P. address and what user is connected to it, pool ip, time etc. The second search below this has an Input field to put the username you just found in and see what recent activity they’ve logged. So, two searches and tables on same page…the problem im having is both tables are showing the results for the first search, instead of being separate so i tryed this xml using two form commands but the xml is invalid when i try and make a view. If i but dashboard at the beginning and end it accepts it but its a blank dashboard.
PLEASE HELP....i have to get this done today
cheers guys
<form>
<label>patrick help</label>
<searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net)
713228 $inputIP$ | fields _time, vpn_poolip, Username, </searchTemplate>
<earliestTime>-24h</earliestTime>
<latestTime>-0d</latestTime>
<fieldset>
<input token="inputIP" />
</fieldset>
<row>
<table>
<title>Users assigned to IP in last 24 hours</title>
<option name="count">25</option>
</table>
</row>
</form>
<form>
<searchTemplate> $inputUser$ </searchTemplate>
<earliestTime>-24h</earliestTime>
<latestTime>-0d</latestTime>
<fieldset>
<input token="inputUser" />
</fieldset>
<row>
<table>
<title>Users activity in last 24 hours</title>
<option name="count">25</option>
</table>
</row>
</form>
If you find an answer to your question i'm especially interested in 🙂
Have you checked to see if there are any examples of this in the UI Examples app? (You cah download it here: http://www.splunkbase.com/apps/All/4.x/Add-On/app:UI+Examples)
I'm thinking that you will have to use the advanced XML for this. (If you've never used the advanced XML before, it could take more than a day to get your head wrapped around it..., from my experience) Hopefully one of the UI experts will have better news for you