Help with Dashboard Searches

[jhilton90]

So I've got a dashboard about failed login attempts and I want to have a searchable function as well. The searchable function will have four separate search boxes, which will be "Username", "User ID", "Email Address" and "IP Address".

I want it to so that when you search for the username in the username search box, it will retrieve the Username in the username tile, User ID in the user id tile, Email Address in the email address tile and IP Address in the ip address tile. Likewise if you were to search for any of those other things it would return all those results.

Just as a note, the username can be either an email address or a string of numbers and letter

My code looks like this so far:

IP Address Tile:

index=keycloak ipAddress=$ipaddress$
| table ipAddress

Username Tile: 

index=keycloak username=$username$ AND username!="*@*"
| dedup userId
| fields username
| table username

Any help with this would be great

[gcusello]

Hi @jhilton90,

please try something like this:

<form>
  <label>Multiple dropdowns test</label>
  <fieldset submitButton="false">
    <input type="time" token="Time">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="username">
      <label>username</label>
      <search>
        <query>
           index=keycloak 
           | dedup Username
           | sort Username
           | table Username
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>Username="</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>Username</fieldForLabel>
      <fieldForValue>username</fieldForValue>
    </input>
    <input type="dropdown" token="user_id">
      <label>user ID</label>
      <search>
        <query>
           index=keycloak $username$
           | dedup user_id
           | sort user_id
           | table user_id
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>user_id="</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>user_id</fieldForLabel>
      <fieldForValue>user_id</fieldForValue>
    </input>
    <input type="dropdown" token="email">
      <label>Email Address</label>
      <search>
        <query>
           index=keycloak $username$ $user_id$
           | dedup email
           | sort email
           | table email
        </query>
        <earliest>$Time.earliest$</earliest>
        <latest>$Time.latest$</latest>
      </search>
      <prefix>email="</prefix>
      <suffix>"</suffix>
      <choice value="*">All</choice>
      <fieldForLabel>email</fieldForLabel>
      <fieldForValue>email</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>WEventCode</title>
      <chart>
        <search>
          <query>
             index=keycloak $username$ $user_id$ $email$
             | stats count BY username user_id email
          </query>
          <earliest>$Time.earliest$</earliest>
          <latest>$Time.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

I used only three dropdown, but the process is the same.

Ciao.

Giuseppe