Dashboards & Visualizations

Help with Dashboard Searches

jhilton90
Path Finder

So I've got a dashboard about failed login attempts and I want to have a searchable function as well. The searchable function will have four separate search boxes, which will be "Username", "User ID", "Email Address" and "IP Address".

I want it to so that when you search for the username in the username search box, it will retrieve the Username in the username tile, User ID in the user id tile, Email Address in the email address tile and IP Address in the ip address tile. Likewise if you were to search for any of those other things it would return all those results.

Just as a note, the username can be either an email address or a string of numbers and letter

My code looks like this so far:

IP Address Tile:

 

index=keycloak ipAddress=$ipaddress$
| table ipAddress

 

 

Username Tile: 

 

index=keycloak username=$username$ AND username!="*@*"
| dedup userId
| fields username
| table username

 

 

Any help with this would be great

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

please try something like this:

<form>
  <label>Multiple dropdowns test</label>
  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="username">
      <label>username</label>
      <search>
        <query>
           index=keycloak 
           | dedup Username
           | sort Username
           | table Username
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>Username="</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Username</fieldForLabel>
      <fieldForValue>username</fieldForValue>
    </input>
    <input type="dropdown" token="user_id">
      <label>user ID</label>
      <search>
        <query>
           index=keycloak $username$
           | dedup user_id
           | sort user_id
           | table user_id
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>user_id="</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>user_id</fieldForLabel>
      <fieldForValue>user_id</fieldForValue>
    </input>
    <input type="dropdown" token="email">
      <label>Email Address</label>
      <search>
        <query>
           index=keycloak $username$ $user_id$
           | dedup email
           | sort email
           | table email
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>email="</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>email</fieldForLabel>
      <fieldForValue>email</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>WEventCode</title>
      <chart>
        <search>
          <query>
             index=keycloak $username$ $user_id$ $email$
             | stats count BY username user_id email
          </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

I used only three dropdown, but the process is the same.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...