Dashboards & Visualizations

How can I use TERM() phrases that comes from an  Dashboard input field?

Mockjin
Explorer

Hi *

i am trying to search via tstats and TERM() statements. How can i use TERM() phrases that comes from an  Dashboard input field?

for example

Input field= test1,test2

Output search=

| tstats
values(PREFIX(test_content=)) as
test_content
where

index=testindex AND (TERM(host=test1)
OR TERM(host=test2)
by _time PREFIX(host=)

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

hi @Mockjin 
assuming your field & value is like this  inputfield= "test1,test2"  you can do something like this

 

| tstats values(PREFIX(test_content=)) as test_content
where index=testindex AND (TERM(host=mvindex(split(inputfield,","),0)) OR TERM(host=mvindex(split(inputfield,","),1))
by _time PREFIX(host=)

 

 

0 Karma

Mockjin
Explorer

Hi @Gr0und_Z3r0 , thank you for your quick answer. When i try your idea i get the error message "unbalanced parantheses". I changed the Example Search for understanding.

Direct search without inputfield in test_dashboard:

|tstats count where index=_internal AND (TERM(name=dump) OR TERM(name=exec)) by PREFIX(name=)

Example search with _internal index and text field named inputfield in test_dashboard:

inputfield="dump,exec"

|tstats count where index=_internal AND (TERM(name=mvindex(split($inputfield$,","),0)) OR TERM(name=mvindex(split($inputfield$,","),1))) by PREFIX(name=)

 

Any idea why?

0 Karma

Gr0und_Z3r0
Contributor

try this way....

| tstats count where index=_internal by PREFIX(group=) 
| rename group= as group 
| eval inputfield="thruput,queue" 
| where group=mvindex(split(inputfield,","),0) OR group=mvindex(split(inputfield,","),1) 
| table group count

Gr0und_Z3r0_0-1680085156246.png

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...