Dashboards & Visualizations

Dashboards and search time extraction

brywilk_umich
Path Finder

I have a search that works great that I am now building a dashboard for, the problem I am running into is that I am doing a field extraction at the time of search using rex. So when I create the dashboard and have the one token Im entering $ip$ it runs into a issue when it gets to the user field that Im extracting to feed the ldapfilter command. Is there any workaround for this? Or would all the field extraction need to occur beforehand?

src_ip=$ip$ #this is the input text token in the dashboard

(
(index=radius sourcetype=radius src_ip=*) OR   
(index=collaboration) OR 
(index=google) 
) 
| lookup dnslookup clienthost as src_dns OUTPUT clientip as x_src_ip
| eval xx_src_ip=src_ip
| eval src_ip=coalesce(xx_src_ip,x_src_ip)
| iplocation src_ip allfields=true | sort -_time  
**| rex field=user mode=sed "s/@email.edu//g" 
| ldapfilter domain=email.edu search="uid=$user$" attrs="InstRoles"**
0 Karma

somesoni2
Revered Legend

Since $ is a special character used for tokens in dashboards, you need to escape it by using 2 $ signs. LIke this

(
 (index=radius sourcetype=radius src_ip=$ip$) OR   
 (index=collaboration) OR 
 (index=google) 
 ) 
 | lookup dnslookup clienthost as src_dns OUTPUT clientip as x_src_ip
 | eval xx_src_ip=src_ip
 | eval src_ip=coalesce(xx_src_ip,x_src_ip)
 | iplocation src_ip allfields=true | sort -_time  
 **| rex field=user mode=sed "s/@email.edu//g" 
 | ldapfilter domain=email.edu search="uid=$$user$$" attrs="InstRoles"**
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...