Dashboards & Visualizations

Customize Search using input from Dashboard

SplunkNinja85
New Member

I want to customise the search using input passed in the dashboard.

The field in the logs have value  CLASS="/x/y/z/abc/query/v1 Need quick Response"

The input value passed from Dashboard is x-y-z-abc-query-v1.

We want to search the logs using input parameter in the field CLASS containing value /x/y/z/abc/query/v1.

as the input parameter value format is x-y-z-abc-query-v1 and the value to search is /x/y/z/abc/query/v1, how  should the query look like to give result.

Query at the end should look like  index= yyy CLASS="/x/y/z/abc/query/v1*" but how to tackle input parameter looks like /x/y/z/abc/query/v1 and search in the Class Field value.

Please assist.

 

0 Karma

renjith_nair
Legend

You may create a token from the input and pass it in the search.

Please find below a run anywhere example. However, if you are defining input, why don't you set the value as "x/y/z/.." ? Is it a dynamic input?

 

<form>
  <label>Search Input</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="token_name">
      <label>Query</label>
      <choice value="x-y-z-abc-query-v1">Query1</choice>
      <choice value="a-b-c-xyz-query-v2">Query2</choice>
      <change>
        <eval token="query">replace(value,"-","/")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults |eval string="/$query$ Need quick Response"</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

 

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...