Hello, I would like to build a form which includes a set of radio options to choose the search conditions (which encapsulate the input field)
Input text field : name 'search_value'
Radio Group: name 'condition'
radio 1: condition set to 'field_a="*$search_value$*"'
radio 2: condition set to 'field_b="*$search_value$*"'
radio 3: condition set to 'field_c="*$search_value$*" (and more conditions...)'
Search Template: 'index=mytable1 $condition$'
I plan to store the condition content for each radio button in the form of splunk data, to be used by form radio element. I think the ExtendedFieldSearch might be able to do this, but I am not sure if it can achieve two-pass replacing.
Could Anyone who knows how to do this provide an XML form sample to achieve? Thanks!
asked 21 Jun '10, 11:10
Since form tokens are simply string replacements, you can just do:
answered 21 Jun '10, 17:13