Dynamic form search

Dynamic form search

Use dynamic form search to autopopulate a set of radio buttons or drop down list with results from a search. To populate the radio button or drop down options, write a search to run every time you load the page. Or, if you don't want to rerun your search every time you load the page, you can use a saved search to populate drop down list or radio button options.

Make sure you already understand how to build a simple form search -- dynamic form searches build on top of the simple form search structure.

Configuration

You've already configured a form search as described in the simple form search documentation. Now, just change the inputtype to either dropdown or radiobutton.

For example, to configure a dropdown:

<form>
    <label>My form search</label>
    <searchTemplate>$username$</searchTemplate>

    <fieldset>
        <input type= dropdown/>
        MORE CONFIGURATION OPTIONS GO HERE (see below)

    </fieldset>
    
    <row>
        <table>
            <title>Users</title>
            <option name="showPager">true</option>
        </table>
    </row>
</form>

If you want to configure a radio button form search, just specify radio. For example:

<form>
    <label>My form search</label>
    <searchTemplate>$username$</searchTemplate>

    <fieldset>
        <input type= radio/>
        MORE CONFIGURATION OPTIONS GO HERE (see below)

    </fieldset>
    
    <row>
        <table>
            <title>Users</title>
            <option name="showPager">true</option>
        </table>
    </row>
</form>

configuration options

There are more configuration options you'll want to set for your dropdown or radio buttons. For example, a label to appear next to the dropdown or radio buttons, the search to populate the results, etc. None of these options are required by the input type, but you're not going to have a very useful dropdown or radio button set unless you specify some of these. Here are all your options for configuration:

• label = label
  • A label to place next to the generated dropdown.
• default = option
  • The default option to select. If the default option cannot be found, the first option is selected.
• prefix
  • See description for input type="text".
• suffix
  • See description for input type="text".
• choice
  • Requires a value attribute. eg "bar". A dropdown option declared by the user. These appear in the order they are defined and before any options generated by an underlying search.
• populatingSearch
  • A search used to generate fields for the dropdown. Requires the attributes "fieldForValue" and "fieldForLabel". fieldForValue is the field extracted from the populatingSearch and placed in the value of the generated dropdown option. fieldForLabel is the field extracted from the populatingSearch and placed in the label of the generated dropdown.
• populatingSavedSearch
  • Any saved search used to generate fields for the dropdown. Requires the attributes "fieldForValue" and "fieldForLabel". fieldForValue is the field extracted from the populatingSavedSearch and placed in the value of the generated dropdown option. fieldForLabel is the field extracted from the populatingSavedSearch and placed in the label of the generated dropdown.
• earliest
  • Earliest time set in Splunk time format.
• latest
  • Latest time set in Splunk time format.

Dropdown example

<input type="dropdown" token="username">
   <label>Select Name</label>
   <populatingSearch fieldForValue="suser" fieldForLabel="suser"><![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
      | stats count by suser]]></populatingSearch>
   <default>nagrin</default>
   <choice value="*">Any</choice>
</input>

Radio example

<input type="radio" token="username">
   <label>Select Name</label>
   <populatingSearch fieldForValue="suser" fieldForLabel="suser"><![CDATA[sourcetype=p4change | rex "user=(?<suser>\w+)@"
      | stats count by suser]]></populatingSearch>
   <choice value="*">Any</choice>
</input>