Dashboards & Visualizations

Form/View to display "host" "source"

wang
Path Finder

I have defined a form/view and in its result page, there is no info for host or source, like in a regular search results page. How do I include those fields for display?

Tags (1)
0 Karma

wang
Path Finder

OK, I figured it out. I need to add: host source

<row>
  <event>
        <fields>host source</fields> 
        <option name="showPager">true</option>
        <option name="count">50</option>
        <option name="displayRowNumbers">false</option>
  </event>
</row>
0 Karma

wang
Path Finder

Oops, don't know what happened but here again are the form events:

<row>
  <event> 
        <option name="showPager">true</option>
        <option name="count">50</option>
        <option name="displayRowNumbers">false</option>
  </event>
</row>
0 Karma

wang
Path Finder

Thanks for the pointer on including the host and source fields. Now I get them when I run the search manually but still not from the form output. In other words, if I grep the "Saved Search" from the form and execute that manually, the host and source are displayed. But not in the form results page.

It seems like the configuration of the form is suppressing that. Do I need to specify some event options to enable display of extra fields like host and source?

Here is what I have in the form: true 50 false

0 Karma

Genti
Splunk Employee
Splunk Employee

Depending on what your form/view looks like you might want to add this to the search that populates it:

<original search> | fields host source <any additional ones>

Otherwise, provide some more info on how you are building this form/view

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...