Dashboards & Visualizations

How can I use TERM() phrases that comes from an  Dashboard input field?

Mockjin
Explorer

Hi *

i am trying to search via tstats and TERM() statements. How can i use TERM() phrases that comes from an  Dashboard input field?

for example

Input field= test1,test2

Output search=

| tstats
values(PREFIX(test_content=)) as
test_content
where

index=testindex AND (TERM(host=test1)
OR TERM(host=test2)
by _time PREFIX(host=)

Labels (1)
0 Karma

Gr0und_Z3r0
Contributor

hi @Mockjin 
assuming your field & value is like this  inputfield= "test1,test2"  you can do something like this

 

| tstats values(PREFIX(test_content=)) as test_content
where index=testindex AND (TERM(host=mvindex(split(inputfield,","),0)) OR TERM(host=mvindex(split(inputfield,","),1))
by _time PREFIX(host=)

 

 

0 Karma

Mockjin
Explorer

Hi @Gr0und_Z3r0 , thank you for your quick answer. When i try your idea i get the error message "unbalanced parantheses". I changed the Example Search for understanding.

Direct search without inputfield in test_dashboard:

|tstats count where index=_internal AND (TERM(name=dump) OR TERM(name=exec)) by PREFIX(name=)

Example search with _internal index and text field named inputfield in test_dashboard:

inputfield="dump,exec"

|tstats count where index=_internal AND (TERM(name=mvindex(split($inputfield$,","),0)) OR TERM(name=mvindex(split($inputfield$,","),1))) by PREFIX(name=)

 

Any idea why?

0 Karma

Gr0und_Z3r0
Contributor

try this way....

| tstats count where index=_internal by PREFIX(group=) 
| rename group= as group 
| eval inputfield="thruput,queue" 
| where group=mvindex(split(inputfield,","),0) OR group=mvindex(split(inputfield,","),1) 
| table group count

Gr0und_Z3r0_0-1680085156246.png

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...