Dashboards & Visualizations

Add "Text" Input in Dashboard that changes base query

demkic
Explorer

Hello,

I am wondering if it is possible to ADD INPUT of "text" in my dashboard and then when user types in a specific text, say the name of a country, that it changes the base search of all the panels in my dashboard. For example:

assume one of my panels has in the base search written:

source=A amount=B type=C country=Italy | stats count .....

I would like a user of this dashboard to be able to enter a different country (example: Germany) in the textbox (which is located above all the panels in the dashboard) and for it to change the base query in each panel where country does not equal L anymore, but country=Germany. And let the search run normally with this new input.

Tags (1)
0 Karma

woodcock
Esteemed Legend

Yes, this is the whole point of having inputs in a form. Download this app and copy from their examples:

https://splunkbase.splunk.com/app/1603/

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...