How to accept multiple value inputs in a Splunk Form?

marquiselee — Mon, 04 Feb 2013 15:24:44 GMT

So I'm setting up a form/dashboard so that team members can lookup file information. Right now the form can only accept 1 value and thus only return results on the one file. However I'd like like to enable people to enter a comma separated list of values.

e.g. user enters the following fileids into the splunk form, and returns info on all files.
1004043,38945894,8954829,438989233

thoughts?

Re: How to accept multiple value inputs in a Splunk Form?

jonuwz — Mon, 04 Feb 2013 18:28:12 GMT

In advanced XML I've done this in the past :

<module name="ExtendedFieldSearch">
    <param name="field">Comma seperated list</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="multi_search">
            <param name="fillOnEmpty">false</param>
            <param name="prefix">
                <![CDATA[[search * | head 1 | eval CL4="]]>
            </param>
            <param name="suffix">
                <![CDATA[" | makemv delim="," CL4 | mvexpand CL4 | fields CL4] ]]>
            </param>
        </param>
    </param>
</param>

So what you're essentially doing is :

[search * | head 1 | eval CL4="your,comma,seperated,list"| makemv delim="," CL4 | mvexpand CL4 | fields CL4]

which will insert :
((CL4=your) OR (CL4=comma) OR (CL4=seperated) OR (CL4=list))

anywhere you specify $multi_search$ in your main search

topic How to accept multiple value inputs in a Splunk Form? in Splunk Search

How to accept multiple value inputs in a Splunk Form?

Re: How to accept multiple value inputs in a Splunk Form?