Dashboards & Visualizations

How can I use TERM() phrases that comes from an  Dashboard input field?

Mockjin
Explorer

Hi *

i am trying to search via tstats and TERM() statements. How can i use TERM() phrases that comes from an  Dashboard input field?

for example

Input field= test1,test2

Output search=

| tstats
values(PREFIX(test_content=)) as
test_content
where

index=testindex AND (TERM(host=test1)
OR TERM(host=test2)
by _time PREFIX(host=)

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

hi @Mockjin 
assuming your field & value is like this  inputfield= "test1,test2"  you can do something like this

 

| tstats values(PREFIX(test_content=)) as test_content
where index=testindex AND (TERM(host=mvindex(split(inputfield,","),0)) OR TERM(host=mvindex(split(inputfield,","),1))
by _time PREFIX(host=)

 

 

0 Karma

Mockjin
Explorer

Hi @Gr0und_Z3r0 , thank you for your quick answer. When i try your idea i get the error message "unbalanced parantheses". I changed the Example Search for understanding.

Direct search without inputfield in test_dashboard:

|tstats count where index=_internal AND (TERM(name=dump) OR TERM(name=exec)) by PREFIX(name=)

Example search with _internal index and text field named inputfield in test_dashboard:

inputfield="dump,exec"

|tstats count where index=_internal AND (TERM(name=mvindex(split($inputfield$,","),0)) OR TERM(name=mvindex(split($inputfield$,","),1))) by PREFIX(name=)

 

Any idea why?

0 Karma

Gr0und_Z3r0
Contributor

try this way....

| tstats count where index=_internal by PREFIX(group=) 
| rename group= as group 
| eval inputfield="thruput,queue" 
| where group=mvindex(split(inputfield,","),0) OR group=mvindex(split(inputfield,","),1) 
| table group count

Gr0und_Z3r0_0-1680085156246.png

 

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...