https://community.splunk.com/t5/Splunk-Search/Textarea-input-to-feed-a-search/m-p/160233#M185950 <P>I have firewall logs that feed into splunk and I'd like to have a textarea form input where I can paste in a handful of IP addresses (one per line) and have those feed a search like:<BR /> index=fw |where &lt;any textareaIP == src_ip OR any textareaIP == dest_ip&gt;</P> <P>Seems like it would be a join, but I'm not sure how to get the multiple inputs into a search (not if a textarea is possible at all)</P> Mon, 28 Sep 2020 20:16:59 GMT bgriffis 2020-09-28T20:16:59Z https://community.splunk.com/t5/Splunk-Search/Textarea-input-to-feed-a-search/m-p/160233#M185950 <P>I have firewall logs that feed into splunk and I'd like to have a textarea form input where I can paste in a handful of IP addresses (one per line) and have those feed a search like:<BR /> index=fw |where &lt;any textareaIP == src_ip OR any textareaIP == dest_ip&gt;</P> <P>Seems like it would be a join, but I'm not sure how to get the multiple inputs into a search (not if a textarea is possible at all)</P> Mon, 28 Sep 2020 20:16:59 GMT https://community.splunk.com/t5/Splunk-Search/Textarea-input-to-feed-a-search/m-p/160233#M185950 bgriffis 2020-09-28T20:16:59Z https://community.splunk.com/t5/Splunk-Search/Textarea-input-to-feed-a-search/m-p/160234#M185951 <P>Hi bgriffis,</P> <P>Take a look at the dashboard example app <A href="https://splunkbase.splunk.com/app/1265/">https://splunkbase.splunk.com/app/1265/</A> there you can find multiple <CODE>Form Input Elements</CODE>. Most likely it will be a <CODE>multi-select input</CODE> and for sure no need to <CODE>join</CODE> the search. You can define prefixes and suffixes for you input element, so you are able to build something like <CODE>myinput=foo OR myinput=boo</CODE>.</P> <P>Hope that helps ...</P> <P>cheers, MuS </P> Wed, 17 Jun 2015 21:06:40 GMT https://community.splunk.com/t5/Splunk-Search/Textarea-input-to-feed-a-search/m-p/160234#M185951 MuS 2015-06-17T21:06:40Z