topic Re: Help on input text token in Splunk Search

Help on input text token

jip31 — Wed, 05 Jul 2023 16:28:30 GMT

I use an input text token in.my dashboard in order to retrieve spécifications numériques for a field

It works but i would like the possibility to add >= before the number

Ex: >=200

How todo please?

Re: Help on input text token

gcusello — Wed, 05 Jul 2023 16:44:19 GMT

HI @jip31 ,

you have to add a prefix to your text input

<input type="text" token="your_token"> <label>Your Threshold</label> <default>0</default> <prefix>your_field>=</prefix> </input>

Ciao.

Giuseppe

Re: Help on input text token

jip31 — Thu, 06 Jul 2023 12:31:47 GMT

Unfortunately not

Here is my code

<label>logon</label>

</input>

Re: Help on input text token

gcusello — Thu, 06 Jul 2023 12:42:11 GMT

Hi @jip31,

in the prefix, you have to add also the field name:

<prefix>your_field>=</prefix>

Ciao.

Giuseppe

Re: Help on input text token

jip31 — Thu, 06 Jul 2023 15:09:04 GMT

It doesnt works

<prefix>your_field&gt;=</prefix>

<prefix>LastLogon>=</prefix>

Re: Help on input text token

gcusello — Thu, 06 Jul 2023 15:14:45 GMT

Hi @jip31,

could you share your code?

Ciao.

Giuseppe

Re: Help on input text token

jip31 — Fri, 07 Jul 2023 06:34:11 GMT

<label>logon</label>

<prefix>"LastLogonAge">=</prefix>

</input>

And after my stats command i put

Re: Help on input text token

gcusello — Fri, 07 Jul 2023 06:14:29 GMT

Hi @jip31,

no, you doubled the field definition.

You have two choices:

insert the field definition in the text input, but in the search put only the token:

<label>logon</label> <default></default> <prefix>LastLogonAge>=</prefix> And after the stats command you can put | search $logon$

don't use prefix and insert the field definition in the search

<label>logon</label> <default></default> And after the stats command you can put | search LastLogonAge>=$logon$

Ciao.

Giuseppe