https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321947#M4542 <P>You're probably looking for a dashboard with form inputs?</P> <P>If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:</P> <PRE><CODE>index=foo sourcetype=bar src="$src_token$" dest="$dest_token$" </CODE></PRE> <P>Configure the search to use the time range picker.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms">http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms</A></P> Wed, 22 Feb 2017 10:24:16 GMT martin_mueller 2017-02-22T10:24:16Z https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321946#M4541 <P>We have a portal that is used by the SOC for malware investigations. The portal has the ability to login to Splunk &amp; conduct searches.</P> <P>How can I generalise the search to match the particular event. For example:</P> <P>Source IP: A.B.C.D<BR /> Target IP: D.E.F.G<BR /> Date &amp; Time: 22/02/2017 14:00</P> <P>Our aim is to pull the specific event from Splunk.</P> <P>The IP &amp; date/time will change for each event.</P> <P>Thanks heaps.</P> Wed, 22 Feb 2017 06:25:05 GMT https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321946#M4541 viay32 2017-02-22T06:25:05Z https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321947#M4542 <P>You're probably looking for a dashboard with form inputs?</P> <P>If so, create inputs for the source ip, target ip, and a time range picker. Then use a search something like this:</P> <PRE><CODE>index=foo sourcetype=bar src="$src_token$" dest="$dest_token$" </CODE></PRE> <P>Configure the search to use the time range picker.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms">http://docs.splunk.com/Documentation/Splunk/6.5.2/Viz/Buildandeditforms</A></P> Wed, 22 Feb 2017 10:24:16 GMT https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321947#M4542 martin_mueller 2017-02-22T10:24:16Z https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321948#M4543 <P>Thanks heaps martin_mueller. I will test this out.</P> Wed, 22 Feb 2017 11:12:37 GMT https://community.splunk.com/t5/Splunk-Dev/Pull-a-specific-event-from-Splunk/m-p/321948#M4543 viay32 2017-02-22T11:12:37Z