topic Re: Splunk Dashboard Text FIlter in Splunk Search

How to achieve Splunk Dashboard text filter?

CodingMaestro — Thu, 11 May 2023 13:50:04 GMT

I have a splunk dashboard that looks like below,

And i have added the text filter. But when i try to search of the text filter it works. But it only works when i search by one App. But i want it to search so that if i search,
Max, Pan, Ian
It will give me the details for the 3 rows. I have 4000 unique apps so i want it so that if i search Max, Pan, Ian it will give me 3 row details.

If someone can help me on this, it would be greatly appreciated.

Re: Splunk Dashboard Text FIlter

ITWhisperer — Thu, 11 May 2023 12:09:06 GMT

I presume you have an text input and are using the token in the search for the table.

Are you working with Classic / SimpleXML dashboard or Dashboard Studio?

Re: Splunk Dashboard Text FIlter

CodingMaestro — Thu, 11 May 2023 12:39:03 GMT

Yes that's correct,

And its a classic dashboard

Re: Splunk Dashboard Text FIlter

ITWhisperer — Thu, 11 May 2023 12:48:25 GMT

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

Re: Splunk Dashboard Text FIlter

CodingMaestro — Thu, 11 May 2023 13:08:21 GMT

Could you please explain further how to set up a change handler, and how to do it. Thanks.

Re: Splunk Dashboard Text FIlter

ITWhisperer — Thu, 11 May 2023 13:32:54 GMT

I thought by your handle you were a Maestro? 😀

Depending on how sophisticated you want to be in preprocessing the text input (here I have just removed embedded spaces), you could try something like this

<form version="1.1"> <label>Text parsing</label> <fieldset submitButton="false"> <input type="text" token="apps"> <label>Application filter</label> <change> <eval token="app_filter">"\"".mvjoin(split(replace($apps$," ",""),","),"\",\"")."\""</eval> </change> </input> </fieldset> <row> <panel> <html>... app IN ($app_filter$)</html> </panel> </row> </form>

Re: Splunk Dashboard Text FIlter

CodingMaestro — Thu, 11 May 2023 13:35:52 GMT

This Alone worked, Thanks.