Can dashboard provide results based on the search I provide separately?

[hcheang]

Hello,

I have a quick question regarding dashboard. I would like to know if the search queries I have provided on dashboard panels can be applied after I input some value such as a user name. What I mean is that based on the username I provide on search head or wherever, the panels will give results. In other words, theses panels will give different results based on the username. Basically, I want to create a dashboard which summarize user activity.

Search queries I'm using are:
%Windows failed logins (count and source)
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by user dst src|fields user src dest count|rename dst as System|sort -count

%Windows failed logins (times)
Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) | bucket _time span=1h | stats count by _time user

%Windows successful logins
EventCode=4624 Logon_Type=10 |stats count by _time host, user, src |sort –count

If all fails, my plan is to mimic the time picker to create user picker... am I going in right direction?

[ramdaspr · Accepted solution]

Yes, you will need to create input fields and tokenize them so that the dashboard queries can pickup those queries and populate the tables.
For example, you can create a textfield with a token txt_tok

<input type="text" token="txt_tok">
      <label>UserName</label>
    </input>

and use the token in a dashbaord panel search query

Keywords="Audit Failure" (EventCode=4625 OR EventCode=4771) |stats count by $txt_tok$ dst src|fields $txt_tok$ src dest count|rename dst as System|sort -count

[hcheang]

works like magic! thanks!