controlling search conditions by form element

Question

Hello, I would like to build a form which includes a set of radio options to choose the search conditions (which encapsulate the input field)

For example:

Input text field : name 'search_value'

Radio Group: name 'condition'

radio 1: condition set to 'field_a="*$search_value$*"'

radio 2: condition set to 'field_b="*$search_value$*"'

radio 3: condition set to 'field_c="*$search_value$*" (and more conditions...)'

Search Template: 'index=mytable1 $condition$'

I plan to store the condition content for each radio button in the form of splunk data, to be used by form radio element. I think the ExtendedFieldSearch might be able to do this, but I am not sure if it can achieve two-pass replacing.

Could Anyone who knows how to do this provide an XML form sample to achieve? Thanks!

Accepted Answer

2

Since form tokens are simply string replacements, you can just do:

<input type="text" token="search_value" />

<input type="radio" token="condition">
    <choice value="field_a">Option 1</choice>
    <choice value="field_b">Option 2</choice>
    <choice value="field_c">Option 3</choice>
</input>

<searchTemplate>index="mytable1" $condition$="$search_value$"</searchTemplate>

link

answered 21 Jun '10, 17:13

gkanapathy ♦
32.3k●4●8●27
accept rate: 41%

Thanks! Can I do more complicated replacement like for the radio 3 in my example?

(22 Jun '10, 02:21) kalitbri

Well, if it's much more complicated than that, you can use a macro to pass in a value and transform it almost arbitrarily. It can get a little confusing with multiple levels of string substitution, but it is possible. See docs for macros and macros.conf.spec file.

(22 Jun '10, 02:27) gkanapathy ♦

controlling search conditions by form element

Follow this question

Splunk Resources

Related questions