Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Dashboard text input - accepting null and escaping...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dashboard text input - accepting null and escaping back slashes
Hi,
My dashboard has a few text boxes and I'm trying to make the inputs as user friendly as possible.
I came across multiple issues which I have solved with previous posts however, there is a conflict with the solutions that prevent me from implementing both at the same time.
#1 - If a text input is empty then that field should be ignored in the search. This can be fixed by adding a prefix and suffix
Ideally we can also input partial paths so there is also an implicit * character.
<input type="text" token="Get_Process_Path">
<label>Process Name or Path</label>
<prefix>process_path="*</prefix>
<suffix>*"</suffix>
</input>
#2 - Interpret back slash characters as text so we don't need to manually add \\ to every path. The |s filter for tokens fixed this.
process_path=$Get_Process_Path|s$
I can get both of these working on their own but not at the same time. Is there a way to do this or do I need a different approach?
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why are you using
proces_path=$Get_Process_Path|s$if $Get_Process_Path$ already has the process_path="* prefix? Is this what is causing the issue?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have tried this without the proces_path= assignment since that is in the prefix, so just $Get_Process_Path|s$
Here is a snippet:
<input type="text" token="Get_Process_Path">
<label>Process Name or Path</label>
<prefix>process_path="*</prefix>
<suffix>*"</suffix>
</input>
<query>index=windows EventCode=4688
$Get_Process_Path|s$
This will break the search, I believe it's because |s is wrapping additional quotes around what is in the prefix.
But I need both of those things to fix the individual issues.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See this example dashboard - this uses a <change> block on the input to change the token
<form version="1.1" theme="light">
<label>Backslash escaped input</label>
<fieldset submitButton="false">
<input type="text" token="Get_Process_Path" searchWhenChanged="true">
<label>Enter Path</label>
<prefix>process_path="*</prefix>
<suffix>*"</suffix>
<change>
<eval token="escaped_path">replace($Get_Process_Path$, "\\\\", "\\\\")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<html>Token created from the user's input is <b style="color:blue">[$Get_Process_Path$]</b> and the up[dated search token applied is <b style="color:red">[$escaped_path$]</b></html>
<table>
<search>
<query>index=_audit $escaped_path$</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
