Archive

How to add filter specific to each column in SPLUNK dashboard

New Member

I am creating a Dashboard from Splunk log

In this dashboard, I want to want to add the filter to each column. Just by writing into filter text box, data need to be filtered. something like this.

I have also asked same question on stackoverflow.
https://stackoverflow.com/questions/43934866/how-to-add-filter-specific-to-each-column-in-splunk-das... text]1

Tags (1)
0 Karma

Esteemed Legend

Like this:

| multisearch
    [ |makeresults | eval _time = "   Search Time", message = "   Search Message" ]
    [ YOUR ORIGINAL SEARCH HERE ]

If you need it to be tokenized, then like this:

| multisearch
    [ |makeresults | eval _time = "   " . $time_token$, message = "   " . $message_token$ ]
    [ YOUR ORIGINAL SEARCH HERE ]
0 Karma

Communicator
  1. Save the search of the reports as dashboard panel
  2. edit the dashboard
  3. add a input
  4. in the config of the Input rename the token to filter1_tok or a name_abc_tok or..._tok
  5. connect the Input with the Visualization: Button "magnifying glass" edit search --> time range score --> select your token ".._tok"
  6. finish

Look here too:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Viz/Aboutthismanual

0 Karma

Communicator

input at a dashboard are equal filter 😉

0 Karma