Skip to main content

Step 3 - Configure fields

Fields control the inputs available within each section, and do not have to contain all fields that are defined within a KV Store.

If you have removed a field, or added new fields to the collections.conf for the KV Store, press the Scan for new fields button at the top of this section.

  1. Fields are automatically extracted from the KV Store, including their type. The display name by default is the same as the field name, but update this to give the user a readable value.
  2. Optionally, mark the field as required in the top bar of the field configuration view.
  3. Optionally, provide a description of the field.
  4. Select the section this field should belong to. By default, all fields are added to the first section.
  5. Optionally, select a specific Splunk role that can edit this field. (only available if RBAC is enabled globally, and roles have been selected for this form)
  6. Select input type:
    • Text -> Short text.
    • Text Area -> Long Text Input.
    • Number -> I'm not going to explain this one.
    • Boolean -> True / False values.
    • Date & Time -> Date & Time, stored as a unix epoch.
    • List -> Either hard-coded or Splunk search values. See below for more info on this.
  7. Optionally, set a Default Value that is displayed to the user.
  8. Optionally, set validation regex (when in doubt, check out regex101.com, which is an amazing tool), to validate the fields (e.g. make the user provide a valid email).
  9. Optionally, set a Custom Error Message to display when the regex fails.

The fields can then be moved within a section, by pressing the Move Up or Move Down buttons.

List Options​

A list can have hard coded or splunk search results returned to a user. Press Configure List to edit these options

Hard Coded​

When this mode is selected, you can enter multiple Display Name and Stored Value entries.

A splunk search can be used to return values to the user. For example, from an index or another kv store lookup.

Note: The user must have permissions to run the search - if they don't, then options will fail to load.

When designing your search, it must return two fields: display_value and value.