topic Re: Splunk dashboard filter by user input with multiple value from user command field in Dashboards & Visualizations

Splunk dashboard filter by user input with multiple value from user command field

elend — Thu, 18 Jul 2024 08:54:23 GMT

Hello there, im creating a #Splunk Dashboards table that utilized to monitor user command. And i want to make it flexible and dynamic to view the table by user inpu
For now i already create this search string as table that can apply filter by Find Command and Exclude Command, but it only accept single string as filter.

index=os_linux sourcetype="bash_history" | dedup timestamp | fields _time process, dest, user_name | search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process="$exclude_command$" | table _time user_name process dest | rename dest as hostname, process as user_command | sort -_time

It is possible to make the exclude_command accept multiple values with some separator? or another option recomended.

Re: Splunk dashboard filter by user input with multiple value from user command field

ITWhisperer — Thu, 18 Jul 2024 09:05:44 GMT

Depending on how you have set up your exclude_command token (which you haven't shared with us yet), you could try something like this

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN $exclude_command$

Re: Splunk dashboard filter by user input with multiple value from user command field

elend — Thu, 18 Jul 2024 09:32:24 GMT

Re: Splunk dashboard filter by user input with multiple value from user command field

elend — Thu, 18 Jul 2024 09:22:06 GMT

sorry for lack of information @ITWhisperer . Here's the full information for the dashboard:

<panel> <title>Logging Command History by User</title> <input type="text" token="drilldown_command" searchWhenChanged="true"> <label>Find Command</label> <default>*</default> </input> <input type="text" token="exclude_command" searchWhenChanged="true"> <label>Exclude Command</label> <default>NULL</default> </input> <table> <search> <query>index=unix_os sourcetype="bash_history" | dedup timestamp | fields _time process, dest, user_name | search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process="$exclude_command$" | table _time user_name process dest | rename dest as hostname, process as user_command | sort -_time</query> <earliest>$time_global.earliest$</earliest> <latest>$time_global.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">10</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">false</option> </table> </panel>

Re: Splunk dashboard filter by user input with multiple value from user command field

ITWhisperer — Thu, 18 Jul 2024 10:01:51 GMT

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN ($exclude_command$)

Note that your user will have to enter the terms as quoted strings delimited by commas e.g. "commandA","commandB"

Re: Splunk dashboard filter by user input with multiple value from user command field

elend — Thu, 18 Jul 2024 10:31:20 GMT

With that option, exclude input was ignored.
But if with this one changes it can apply exclude input only one value.

| search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT process IN (*$exclude_command$*)

If search terms as quoted strings delimited by commas e.g. "commandA","commandB" it give no result:

Re: Splunk dashboard filter by user input with multiple value from user command field

ITWhisperer — Thu, 18 Jul 2024 10:57:12 GMT

What is with the asterisks? Remove them and try again

Re: Splunk dashboard filter by user input with multiple value from user command field

elend — Thu, 18 Jul 2024 11:05:08 GMT

if I remove the asterix, Exclude Command input ignore any input even single input will ignored so it only show table from find command.

Re: Splunk dashboard filter by user input with multiple value from user command field

ITWhisperer — Thu, 18 Jul 2024 11:36:28 GMT

Can you open the search (from the dashboard table) in a separate table and share the search being used?

Re: Splunk dashboard filter by user input with multiple value from user command field

elend — Fri, 19 Jul 2024 02:58:34 GMT

Here's the output from your provided search query, it ignoring the exclude input.

Re: Splunk dashboard filter by user input with multiple value from user command field

ITWhisperer — Fri, 19 Jul 2024 06:35:10 GMT

You need to split process up if you want to treat the parts of the command line up as separate things. Try this

| eval parts=split(process," ") | search user_name=$user_name$ dest=$host_name$ process="$user_command$" NOT parts IN ($exclude_command$)