I have a simple dashboard that has two input fields and a submit button and I would like to validate the fields.
If the user does not enter a value for the testName field, I would like to perform the search with a wildcard, i.e. * . If they do enter a value, I will use that input in my search.
I have tried various versions of the below code, but haven’t had any luck. I’m sure this type of form validation is simple, but since I’m relatively new to Splunk I can’t get it quite right.
<form>
<label>Sent to External System</label>
<fieldset submitButton="true">
<input type="text" token="id">
<label>ID</label>
</input>
<input type="text" token="testName">
<label>Test Name</label>
</input>
</fieldset>
<row>
<panel>
<event>
<search>
<query>sourcetype=myLog* CFE_LogComponent=Sent payload NOT "sched" "*$id$*" eval testName = if(isNull(testName) OR testName="", "*", testName)</query>
<earliest>@mon</earliest>
<latest>now</latest>
</search>
</event>
</panel>
</row>
</form>
... View more