topic Re: How to filter comma separate keywords in splunk dashboard using text box? in Splunk Search

How to filter comma separate keywords in splunk dashboard using text box?

karthi2809 — Fri, 06 Dec 2024 13:51:45 GMT

How to filter using text box with multiple keywords using comma separated.How to filter my table data.

This is my query

Re: How to filter comma separate keywords in splunk dashboard using text box?

yuanliu — Fri, 06 Dec 2024 17:17:04 GMT

To ask an answerable data analytics question, follow these golden rules; nay, call them the four commandments:

Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search (SPL that volunteers here do not have to look at).
Illustrate the desired output from illustrated data.
Explain the logic between illustrated data and desired output without SPL.
If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.

To apply here: What is "my table data"? Suppose by "text box" you mean a text input element in a dashboard that gives you a token $text_tok$, and suppose your user typed "sometext, some more, some more text". What exact result from your "table data" do you expect? Is the illustrated search supposed to demonstrate your attempt to use such a token? Where is the token if so? If not, what is it supposed to tell volunteers?

Re: How to filter comma separate keywords in splunk dashboard using text box?

karthi2809 — Mon, 09 Dec 2024 11:54:15 GMT

Hi @yuanliu

I am working on a dashboard in splunk and need help implementing specefic filtering requirements.I have a table with the following fields.

message (contain log details)

component (indicates the source components)

My requirement are:

1.Add multiselect dropdown to filter the component field.

2. add textbox input to filter the message field using comma-separated keywords.

for example:

if the textbox contains error, timeout it should filter rows where the message field contain error or timeout in case both present we need to show both the values.

Any suggestions or example are greatly appreciated, Thank you.

Re: How to filter comma separate keywords in splunk dashboard using text box?

yuanliu — Thu, 12 Dec 2024 05:18:33 GMT

You are really just repeating the same question all these days without showing your effort. I have a fairly elaborate response in your other question How to filter events using text box values including sample dashboards. Please delete repeating posts and work on the post where volunteers have provided you with the most information.