topic Re: Validate Splunk Form Input in Dashboards & Visualizations

Validate Splunk Form Input

sscandoit — Fri, 05 Aug 2011 15:12:12 GMT

Hi All,

I am new to Splunk. I have a form with 2 input boxes which I would like to validate before performing the search. I want to make sure that the user provides correct input for performing the search. I tried searching the forum and documentation but I couldn't find any info.

Is there a way to do it?

Thanks in advance,
Suvelee

Re: Validate Splunk Form Input

yoho — Tue, 05 Nov 2013 09:15:32 GMT

I wish I could also perform input validation in forms. For instance, I would like users to be able to type in an IP address in a text field but would like to make sure it's a valid IP address and is not a splunk search, for instance.

Re: Validate Splunk Form Input

rahul_jasrotia — Fri, 13 Jan 2017 06:01:50 GMT

Is this possible to do ? I'm also trying to achieve something like this?

Re: Validate Splunk Form Input

dineshraj9 — Fri, 13 Jan 2017 08:54:20 GMT

You can try something like this within the search query -

 | gentimes start=-1 | eval IP_ADDRESS="10.10.10.10" | eval SEARCH=if(match(IP_ADDRESS,"^\d+\.\d+\.\d+\.\d+$"),[search index=<your_index> earliest=-1m | stats count as count1 by index| return $count1 ] ,"invalid input") | table SEARCH

Here if value of user entered IP_ADDRESS doesn't match the pattern, it will show "invalid input" in the results, else it shows the count from the subsearch.