Same question as here.
XML:
<form>
<label>LIST</label>
<fieldset>
<input type="dropdown" token="printer">
<label>Select Printer</label>
<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
printer_list
</populatingSavedSearch>
</input>
<input type="time" />
</fieldset>
<row>
<chart>
<searchTemplate>index="printer-stats" printer=$printer$|stats values(Black) as Black values(Cyan) as Cyan values(Magenta) as Magenta values(Yellow) as Yellow by _time</searchTemplate>
<title>Toner Stuff</title>
<option name="charting.seriesColors">
[0xF000000,0x00CDCD,0xCC0099,0xFFFF00]</option>
<option name="charting.chart">area</option>
<option name="charting.primaryAxisTitle.text">Time</option>
<option name="charting.secondaryAxisTitle.text">Percent</option>
<option name="charting.legend.placement">bottom</option>
</chart>
</row>
</form>
$SPLUNK_HOME/etc/apps/PrinterStatus/local/savedsearches.conf:
[printer_list]
alert.suppress = 0
alert.track = 0
cron_schedule = * * * * *
description = gets list of all printers found using getstatus script
dispatch.earliest_time = 0
dispatch.latest_time = now
displayview = report_builder_display
enableSched = 1
search = index="printer-stats" |top limit=0 printer|fields + printer|sort printer
vsid = *:hb70ayyx
This search runs every minute and I can see recent results, and have set permissions to global, yet I still get
Module SearchSelectLister_0_0_0: Could not find a saved search named " printer_list ".
Figured it out, too much whitespace for XML I guess, put
<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
printer_list
</populatingSavedSearch>
on one line:
<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">printer_list</populatingSavedSearch>
and boom, loads
Figured it out, too much whitespace for XML I guess, put
<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">
printer_list
</populatingSavedSearch>
on one line:
<populatingSavedSearch fieldForValue="printer" fieldForLabel="printer">printer_list</populatingSavedSearch>
and boom, loads