https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342566#M43113 <P>You can edit the value of the text field with a subquery.</P> <P>index=XXX [search noop|stats count | eval dest="$ip$"|eval dest=split(dest," ") |table dest]|････<BR /> ↓Correct.<BR /> index=XXX [| noop|stats count | eval dest="$ip$"|eval dest=split(dest," ") |mvexpand dest|fields dest] |････<BR /> （It still worked）<BR /> index=XXX [| noop|stats count | eval dest="$ip$"|eval dest=split(dest," ") |fields dest] |････</P> Wed, 08 Mar 2017 16:07:00 GMT HiroshiSatoh 2017-03-08T16:07:00Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342565#M43112 <P>This seems to be a very simple requirement, but I'm unable to find a solution: I built a dashboard where the user enters an ip address which will then be used in a search like:</P> <PRE><CODE>dest=$ip$ </CODE></PRE> <P>Now what I need is a way to search for 1 or more ip addresses. So, if the user enters "10.1.1.1 10.2.2.8 10.3.3.3" then the following search must be generated:</P> <PRE><CODE>(dest=10.1.1.1 OR dest=10.2.2.8 OR dest=10.3.3.3) </CODE></PRE> <P>Is there a way to do this?</P> Wed, 08 Mar 2017 09:31:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342565#M43112 sptz16 2017-03-08T09:31:00Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342566#M43113 <P>You can edit the value of the text field with a subquery.</P> <P>index=XXX [search noop|stats count | eval dest="$ip$"|eval dest=split(dest," ") |table dest]|････<BR /> ↓Correct.<BR /> index=XXX [| noop|stats count | eval dest="$ip$"|eval dest=split(dest," ") |mvexpand dest|fields dest] |････<BR /> （It still worked）<BR /> index=XXX [| noop|stats count | eval dest="$ip$"|eval dest=split(dest," ") |fields dest] |････</P> Wed, 08 Mar 2017 16:07:00 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342566#M43113 HiroshiSatoh 2017-03-08T16:07:00Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342567#M43114 <P>I think you need an mvexpand command as well (after split).</P> Wed, 08 Mar 2017 16:35:47 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342567#M43114 somesoni2 2017-03-08T16:35:47Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342568#M43115 <P>I also thought so.<BR /> But just by splitting it worked fine.</P> Thu, 09 Mar 2017 00:48:16 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342568#M43115 HiroshiSatoh 2017-03-09T00:48:16Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342569#M43116 <P>For an explanation of how HiroshiSatoh's answer works, see the "format" command.</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Changetheformatofsubsearchresults">https://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Changetheformatofsubsearchresults</A></P> Thu, 09 Mar 2017 05:29:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342569#M43116 DalJeanis 2017-03-09T05:29:22Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342570#M43117 <P>Holy cow, works like a charm! Thanks a lot, HiroshiSatoh!</P> Thu, 16 Mar 2017 09:05:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342570#M43117 sptz16 2017-03-16T09:05:09Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342571#M43118 <P>Ah, but now it's getting more complicated. I need to search for the address list in src AND dest fields, so I tried:</P> <PRE><CODE>[search noop | stats count | eval src="$cidr" | eval src=split(src, " "), dest=split(src, " ") | table src, dest ] </CODE></PRE> <P>But it only returns events where src matches. And this:</P> <PRE><CODE>[search noop | stats count | eval src="$cidr",dest="$cidr" | eval src=split(src, " "), dest=split(dest, " ") | table src, dest ] </CODE></PRE> <P>yields no results at all <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Thu, 16 Mar 2017 09:54:19 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342571#M43118 sptz16 2017-03-16T09:54:19Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342572#M43119 <P>Please perform sub search separately.</P> <P>index=XXX [| noop|stats count | eval src="$cidr$"|eval src=split(src," ") |mvexpand src|fields src] [| noop|stats count | eval dest="$cidr$"|eval dest=split(dest," ") |mvexpand dest|fields dest] |････<BR /> ↓<BR /> ( (src=XXX) OR (src=XXX) OR (src=XXX) OR (src=XXX) ) AND ( (dest=XXX) OR (dest=XXX) OR (dest=XXX) OR (dest=XXX) ) <BR /> ※Please be careful because it is AND condition.</P> Fri, 24 Mar 2017 06:56:38 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-generate-search-from-dashboard-input-with-variable-number/m-p/342572#M43119 HiroshiSatoh 2017-03-24T06:56:38Z