topic Re: Parameters for search in Splunk Search

Parameters for search

klausJohan — Wed, 06 Nov 2013 12:53:58 GMT

Hi,

What would be the available options in order to parameterize a search in a Splunk view ?

Let's say that all events that I'm indexing into Splunk contain a field , and that field can have values from a limited set of values. How would I make it possible for the user to specify that he is interested in events with fields having a particular value.

Thanks

Re: Parameters for search

lukejadamec — Wed, 06 Nov 2013 15:55:59 GMT

If you are searching for a single value, the simply search for it:

field="value"

If you are searching for more then one value, the use the OR operator (must be in caps)

field="value" OR field="value"

Re: Parameters for search

somesoni2 — Wed, 06 Nov 2013 17:35:17 GMT

In the splunk views, you can use any of the Splunk controls like Dropdown (if user has to select from pre-defined values) or textbox which will allow user to specify the filter criteria. After that you can change your search to take values from the control.

If you have a dropdown with name field1 [which provides value for say FIELD1] then your search wil become

index=yourindex sourcetype=yoursourcetype.... FIELD1=$field1$...

You can add many control and use them in your search.

Re: Parameters for search

klausJohan — Thu, 07 Nov 2013 09:27:25 GMT

Dropdown would be perfect for me, if I could dinamically define the available options when the page loads.