Fetch results from a form search

Question

Hi,

I made a simple form search like showed in the Splunk documentation (http://docs.splunk.com/Documentation/Splunk/latest/Developer/Step1CreateAForm).

Is it possible to fetch the results from this search and render it without using the <row> element? For example, is it possible to do something like <html>IP Address $src_ip$ is binded with MAC Address $src_mac$</html>


<form>
  <label>Lookup IP/MAC Addresses</label>
  <searchtemplate>
    sourcetype="DHCP_Log" AND src_ip = $src_ip$ AND src_mac != '' | sort -_time | head 1 | fields src_ip,src_mac
  </searchtemplate>
  <fieldset>
    <input type="text" token="src_ip">
      <label>IP Address</label>
      <default></default>
      <seed></seed>
      <suffix>*</suffix>
    </input>
  </fieldset>
  <row>
    
      <option name="showPager">false</option>
      <option name="count">1</option>
    
  </row>
</form>

Thanks!

Regards, Stefan

Answer 1

0

Not to my knowledge, but what you can do is eval a field to contain the text that you want. Like:

sourcetype="DHCP_Log" AND src_ip = $src_ip$ AND src_mac != '' | sort -_time | head 1 | eval msg="IP Address ".src_ip." is binded with MAC Address ".src_mac | fields msg

link

answered 02 Mar '12, 08:05

Ayn
24.8k●3●7●17
accept rate: 41%

Answer 2

Thanks for your reply. At then end I used Sideview Utils to extract the results.

<view autoCancelInterval="90" isVisible="true" onunloadCancelJobs="true" template="dashboard.html" isSticky="False">
    <label>IP / MAC</label>
    <module name="AccountBar" layoutPanel="appHeader" />
    <module name="AppBar" layoutPanel="appHeader" />
    <module name="SideviewUtils" layoutPanel="appHeader" />

    <module name="HTML" layoutPanel="viewHeader">
            <param name="html"><![CDATA[
                    <h1>Lookup IP and MAC addresses</h1>
            ]]></param>
    </module>

    <module name="TextField" layoutPanel="panel_row1_col1" autoRun="False">
            <param name="name">selectedReport</param>
            <param name="label">Lookup IP/MAC</param>

            <module name="Search" layoutPanel="panel_row2_col1" group="Device information">
                    <param name="search">sourcetype=DHCP_Log AND (src_ip = $selectedReport$ AND src_mac != '') OR (src_ip != '' AND src_mac = $selectedReport$) | head 1</param>
                    <param name="earliest">-120min</param>

                    <module name="HTML">
                            <param name="html"><![CDATA[
                                    <div>IP Address: $results[0].src_ip$<br />
                                    MAC Address: $results[0].src_mac$<br />
                                    </div>
                            ]]></param>
                    </module>
            </module>
    </module>

</view>

Fetch results from a form search

Follow this question

Splunk Resources

Related questions