topic Re: Splunk search based on textbook field in Splunk Search

How to create Splunk search based on textbox field?

srv007 — Mon, 10 Apr 2023 16:18:20 GMT

I have a splunk search query which shows the details but the problem here is it only shows the results if the hostname passed in the text box is with fqdn. If hostname entered is without fqdn it won't show any result. How do I make the query to work if I pass abc123.xyz.com or abc123.

Apologizes if it's already answered, very new to Splunk.

Re: Splunk search based on textbook field

srv007 — Thu, 06 Apr 2023 15:54:38 GMT

Correction -

It's text box pannel and not text book.

Re: Splunk search based on textbook field

gcusello — Thu, 06 Apr 2023 16:02:16 GMT

Hi @srv007 ,

are you speaking of a text input panel to perform a search?

If yes, you can add an asterisk in prefix and suffix:

Ciao.

Giuseppe

Re: Splunk search based on textbook field

woodcock — Thu, 06 Apr 2023 23:00:52 GMT

Have a hidden base search that uses the input from the text box and changes the "$host_from_textbox_token$" value from it like this:

Then use grab "$result.search$" in the "change" section to set another token and use that one everywhere else.

Re: Splunk search based on textbox field

VatsalJagani — Fri, 07 Apr 2023 06:22:03 GMT

Welcome to Splunk Community @srv007 .

I think answer by @gcusello should solve your problem. (Basically using wildcard).

Re: Splunk search based on textbox field

VatsalJagani — Mon, 10 Apr 2023 15:08:09 GMT

Hello @srv007, I'm a Splunk Community Moderator,

Kindly accept the answer posted by @gcusello , as that's the answer to your question.

On my post, you can add "Karma/Upvote" if you like it. That would be appreciated!!

Thanks @srv007 , Happy Splunking!!!