topic Re: How to set a splunk token in a search query in Splunk Search

How to set a splunk token in a search query

rkris — Tue, 04 Aug 2020 03:14:22 GMT

I've created a text form input called 'username' to search for usernames in my dashboard panels and i've set the token value to 'user_name'

Now, I'm trying to add the above token value to this search string which filters out all the users with failed logins

But, I'm not sure how to add the token to this search query. Does anyone know how to do this?

Re: How to set a splunk token in a search query

bowesmana — Tue, 04 Aug 2020 03:24:55 GMT

Just add the following line after your rex statement

| where match(User_Name,"$user_name$") OR | where match(User_Name,"(?i)$user_name$")

The second will do a case insensitive match. Note that this is a partial match. Use any of the regex qualifiers to enhance the search as needed, such as ^ and $ to match the start and end for complete matches.

Re: How to set a splunk token in a search query

rkris — Sun, 09 Aug 2020 04:30:03 GMT

@bowesmana

I used this line in my panel search below

| where match(User_Name,"$user_name$")

And i used the same token in my dropdown field so that i when i select the values from the dropdown field, it will appear in the panel.

When i cancelled the search in the dropdown function, i was supposed to get back all the user accounts with failed logins like this:

Instead, I got this:

How do i get rid of this error?

Re: How to set a splunk token in a search query

bowesmana — Sun, 09 Aug 2020 23:15:59 GMT

When you get the 'waiting for input' and you are using tokens, it generally means the token has not been set, so the search that uses the token will not run.

Not sure why you are seeing that, but I am not sure what you mean by cancelling the dropdown search...