Hi Splunkers,
I'm new to Splunk and trying to create a form to narrow down the search to a specific selected dropdown value on the form.
Requirement :
Select the first dropdown it populates the second dropdown.(Works fine up till here)
My idea is upon selection of the value populated in that second dropdown, I want to execute a search in the panel below(transactions) and produce the search result.
Issue: Upon selection of the second dropdown, the search does not get executed. but when I remove the value in the second dropdown(change) the search is executed and the result appears for my previous search which is not on display anymore.
please help!!!!
heres my forms partial xml below:
<form>
<label>Test_me</label>
<description>Splunk</description>
<fieldset submitButton="true" autoRun="true">
<input type="dropdown" token="trackingparam1" searchWhenChanged="false">
<label>Choose Tracking Parameter 1</label>
<search>
<query>some query to pupulate the drop down</query>
</search>
<fieldForLabel>column</fieldForLabel>
<fieldForValue>column</fieldForValue>
<choice value="All">All</choice>
<change>
<unset token="form.trackingval1"></unset>
<condition value="All">
<set token="queryString"></set>
</condition>
<condition>
<set token="queryString">$trackingparam1$="All"</set>
</condition>
</change>
<default>All</default>
<initialValue>All</initialValue>
</input>
<input type="dropdown" token="trackingval1" searchWhenChanged="false">
<label>Enter Parameter Value 1</label>
<fieldForLabel>Choose Tracking Parameter 1</fieldForLabel>
<fieldForValue>$trackingparam1$</fieldForValue>
<change>
<condition>
**<set token="queryString">$trackingparam1$="$trackingval1$"</set>**(need to execute this upon dropdown selection rather than change)
</condition>
</change>
<search>
<query>index=some query to pupulate the dropdown</query>
</search>
<choice value="*">All</choice>
</input> </fieldset> <row>
<panel>
<title>Transactions</title>
<table>
<search>
<query>index="test" Source="$field$" $queryString$|table TransactionId Name Source Target Status Details
_time</query>
<earliest>$field6.earliest$</earliest>
<latest>$field6.latest$</latest>
</search>
<option name="drilldown">row</option>
<!-- disable the search option for results -->
<option name="link.openSearch.visible">0</option>
<option name="rowNumbers">true</option>
<format type="color" field="Status">
<colorPalette type="map">{"Success":#65A637,"Error":#D93F3C}</colorPalette>
</format>
<fields>["Name","Source","Target","Status","Details","_time"]</fields>
<!-- src_tranid is the field to be drilled down on -->
<drilldown>
<set token="src_tranid">$row.TransactionId$</set>
<set token="src_date">$row.CreatedAt.$date$</set>
</drilldown>
</table>
</panel>
</row>
</form>
Thanks in advance,
buddingsplunker
... View more