hi all ,
i have the field called TaskAction it has upto some 25 fields i want to create dropdown fo those filed how can i do that
pls help me with code
As Ayn said, download this app and you'll find examples with code for the dropdown you would like. Look in the folder ui_examples/default/data/ui/views/
http://splunk-base.splunk.com/apps/22333/splunk-ui-examples-app-for-41
form_dropdown.xml
<form>
<label>Simple select drop down</label>
<!-- define master search template, with replacement tokens delimited with $ -->
<searchTemplate>index=_internal source=*metrics.log group="per_sourcetype_thruput" series=$series$ | fields eps, kb, kbps</searchTemplate>
<earliestTime>-30d</earliestTime>
<latestTime>-0d</latestTime>
<fieldset>
<!-- Define a simple dropdown form driven by a search -->
<input type="dropdown" token="series">
<label>Select series</label>
<populatingSearch fieldForValue="series" fieldForLabel="series"><![CDATA[index=_internal source=*metrics.log group="per_sourcetype_thruput" | top series]]></populatingSearch>
<choice value="*">Any</choice>
</input>
</fieldset>
<row>
<!-- output the results as a 50 row events table -->
<table>
<title>Matching events</title>
<option name="count">50</option>
</table>
</row>
</form>
the problem i found is , the value assigned to $source$ is like C:\Users\homefolder\filename.txt
which is the path of my source file but the one which is needed in the Splunk search command is something like
C:\\Users\\homefolder\\filename.txt
So how to replace "\
" by "\\
"(double backslash) in search command 😞 please help
thankyou
Oh! i am sorry, i didn't change $test$ before posting, actually this form was working fine with a textbox and at that time i used token name as "test" for it. and when i tried to replace textbox with a dropdownbox i used another name for testing what's wrong with the name test, still first chart has to work. but it is not working.. even if i replace $test$ with $sources$ , nothing seems to be changed in my result. it is not generating any chart.
The other thing i might do is simply the view and just get one chart working based on selecting a value from the drop down.
What is the $test$ for...did you replace that with $sources$ previously and it still isn't working? Are you not getting any charts to populate?
Hi, i have tried with the above sample, but i am not getting the return value from the dropdown box in the variable and not able to do the search effectively.. here is my code. can u tell me what's wrong with my code. thanks for your valuable time.
<form>
<label>MAPPING_drop down</label>
<fieldset>
<input type="dropdown" token="sources">
<label>Source:</label>
<populatingSearch fieldForValue="source" fieldForLabel="source">
index=main sourcetype=pc_log |chart count over source
</populatingSearch>
</input>
<input type="time" />
</fieldset>
<row>
<chart>
<title>MAPPING:WRITER </title>
<searchTemplate>
index=main source=$sources$ PC_level="WRITER_*"| chart count by PC_level
</searchTemplate>
<option name="charting.chart">pie</option>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
</chart>
<chart>
<searchTemplate>
index=main source=$test$ PC_level="LKPDP_*" OR PC_level="MAPPING" OR PC_level="TRANSF_*" | chart count by PC_level </searchTemplate>
<title>MAPPING:TRANSFORMATION</title>
<option name="charting.chart">pie</option>
<option name="count">10</option>
<option name="displayRowNumbers">true</option>
</chart>
</row><row>
<chart>
<searchTemplate>
index=main source=$test$ eventtype="PC_READER" |chart count by PC_level </searchTemplate>
<title>MAPPING:READER</title>
<earliestTime>0</earliestTime>
<option name="charting.chart">pie</option>
<option name="count">50</option>
<option name="displayRowNumbers">true</option>
</chart>
</row>
</form>`
The UI examples app has info on how to do dropdowns.