Documentation: 3.3
|  Print Version Contents
This page last updated: 06/25/08 03:06pm

Create a form search

Create a form search the same way you create a saved search, with these additional steps:

  • Decide which parts of the search to turn into variables.
  • Specify variables as form fields by surrounding them with dollar signs ($).

For example, the search

$foo$Search

will appear as the following:

http://www.splunk.com/assets/doc-images/FormSearch/foo.jpg

Form searches with fields

Create form searches for indexed and extracted fields.

Preface your form field with the field name and surround the form field with quotes.

For example:

index=_internal AND sourcetype=splunkdSearch

can be made into a general (form) search for any sourcetype by adding sourcetype after the indexed field name and surrounding it with dollar signs:
index=_internal AND sourcetype="$sourcetype$"Search

Save this search as Daily indexing volume, and a user running the search sees:

http://www.splunk.com/assets/doc-images/FormSearch/DailyIndexingVolume2.jpg

Form searches with predefined values

You can also specify form searches that have a list of valid values. The form generated will show a drop-down list. For example, the search

sourcetype=_trade_entry AND TradeID="$Trade ID$" AND TradeType $TradeType=Accepted,Rejected,Hold$

This search limits TradeType to three values and presents them in a drop-down:

http://www.splunk.com/assets/doc-images/FormSearch/SavedSearchDropList.png

Valid values can also come from an external source. For example:

$user={/static/html/imap.users}$

Note: The external source must be accessible as a URL from the local domain. The file should live in $SPLUNK_HOME/share/splunk/search_oxiclean/static/html, should be a plain text file and contain the values that you want to show in the drop-down list in the following format:

['value1','value2','value3','value4']

Share your form search

Once you have refined your search, you can distribute it to your users.

Save it

  • Save your search via the drop-down arrow next to the search box.
    • From within the form search interface, click click show as text to return to the search box.
    • You can share your saved search with all users.

Permalink it

  • Once you have saved a search, you can permalink to the form search box.
    • View the saved search in the form view mode, and click the permalink option above the form search box. This creates a permalink URL that you can send to other Splunk users.
Previous: Customize alert options    |    Next: Macro searches

Comments

No comments have been submitted.

Log in to comment.