topic Re: How do I search for events under a Splunk Token? in Dashboards & Visualizations

How do I search for events under a Splunk Token?

tycarterbk1 — Tue, 18 Sep 2018 20:00:49 GMT

I have the following token value "7FB3A2D9......"
I want to view events submitted under this token.
• Number of events
• Details of event

Re: How do I search for events under a Splunk Token?

mstjohn_splunk — Tue, 18 Sep 2018 20:10:51 GMT

hi @tycarterbk1

Thanks for posting. Could you give us some more context for your query? You have a much better chance of getting your question answered if you provide more information about your issue. Plus, it will help guide future community users who are facing a similar problem.

Re: How do I search for events under a Splunk Token?

tycarterbk1 — Tue, 18 Sep 2018 20:16:26 GMT

Hi @mstjohn_splunk
I have a following token value "7FB3A2D9......"
The user wants to see • Number of events and • Details of event associated with this token.

Does this clear things up?

Re: How do I search for events under a Splunk Token?

lucasfbeinjamin — Tue, 18 Sep 2018 20:19:41 GMT

Hey @tycarterbk1
Please i need more information about your query to be able to respond in the best possible way.

Re: How do I search for events under a Splunk Token?

tycarterbk1 — Tue, 18 Sep 2018 20:23:08 GMT

Hi @lucasfbeinjamin
I have a following token value "7FB3A2D9......"
The user wants to see • Number of events and • Details of event associated with this token.
Does this clear things up?
I do not have a query thats what I'm trying to figure out now

Re: How do I search for events under a Splunk Token?

lucasfbeinjamin — Tue, 18 Sep 2018 20:38:46 GMT

Hey buddy @tycarterbk1
I do not know if it's exactly what you wanted but I tried to answer you through an example code, hope you can approve and learn something from it.

<form>
<row>
    <panel>
      <input type="dropdown" token="YOUR_TOKEN" searchWhenChanged="true">
        <fieldForLabel>your_field</fieldForLabel>
        <fieldForValue>your_field</fieldForValue>
        <search>
          <query>index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE
| dedup field1
| table field1</query>  <!--(I'm doing that to populate the dropdown)-->
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <default>7FB3A2D9</default> <!-- Here i set a default value to the dropdown-->
      </input>

  <!-- SEARCH 1 -->
  <row>
    <panel>
      <chart>
        <search>
          <query>index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE $YOUR_TOKEN$ 
| stats count() by id <!--(Here you can count your events by anything you need "id, code, etc...")-->
</query>
        </search>
      </chart>
    </panel>
  </row>

  <!-- SEARCH 2 -->
  <row>
    <panel>
      <chart>
        <search>
          <query>index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE $YOUR_TOKEN$ 
| table Field1, Field2, Field3 .... <!--(Here you put your fields that you need)-->
          </query>
        </search>
        </chart>
     </panel>
   </row>
</form>