Dashboards & Visualizations

How do I read comma separated inputs from a single text input box in a form?

Kwip
Contributor

Hi Team,

I am creating a form where a user can input a set of values separated by commas. Below are the details and example.

I need to generate a table with a set of jobs along with some other information.

The job name will have a unique ID. Those IDs will be provided as a comma separated input by the user.

Job_Name=aaa.bbb.ccc.xxxxx(UniqueID).dddddd.ccccc

So, the user input needs to be applied in the Job_Name field in a OR condition. Like below,

Say example user imput is 12345, 09876, 67543

I need to generate a search like index=something sourecetype=something Job_Name=aaa.bbb.ccc.12345.dddddd.ccccc OR aaa.bbb.ccc.09876.dddddd.ccccc OR aaa.bbb.ccc.67543.dddddd.ccccc.

Please help me out on this.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Kwip

Can you please try this?

<form>
   <label>Job Search</label>
   <fieldset submitButton="false">
     <input type="text" token="input_jobs">
       <label>IDs (comma-separated)</label>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <search>
           <query> index=something sourecetype=something  [| makeresults | eval input="$input_jobs$" | eval Job_Name=split(input,",") | mvexpand Job_Name |eval Job_Name="aaa.bbb.ccc.".Job_Name.".dddddd.ccccc" | table Job_Name  ]   </query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>
   </row>
 </form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Kwip

Can you please try this?

<form>
   <label>Job Search</label>
   <fieldset submitButton="false">
     <input type="text" token="input_jobs">
       <label>IDs (comma-separated)</label>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <search>
           <query> index=something sourecetype=something  [| makeresults | eval input="$input_jobs$" | eval Job_Name=split(input,",") | mvexpand Job_Name |eval Job_Name="aaa.bbb.ccc.".Job_Name.".dddddd.ccccc" | table Job_Name  ]   </query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>
   </row>
 </form>

Thanks

0 Karma

Kwip
Contributor

Awesomw @kamlesh_vaghela. This is what I am looking for.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Glad to help you. 🙂
Happy Splunking

0 Karma

whrg
Motivator

I think it might be easier in your case to use a subsearch instead of OR conditions.

My idea was to extract the UniqueID from the events in the base search. (You could also use a field extraction instead of the rex command.) The subsearch will then match the UniqueIDs against the user input. Have a look at this dashboard:

<form>
  <label>Job Search</label>
  <fieldset submitButton="false">
    <input type="text" token="input_jobs">
      <label>IDs (comma-separated)</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=3 | streamstats count
| eval Job_Name=case(count==1,"aaa.bbb.ccc.12345.dddddd.ccccc",count==2,"aaa.bbb.ccc.09876.dddddd.ccccc",count==3,"aaa.bbb.ccc.67543.dddddd.ccccc")
| rex field=Job_Name "aaa\.bbb\.ccc.(?<UniqueID>[\d]+)"
| search [| makeresults count=1
   | eval input="$input_jobs$"
   | eval input=replace(input," ","")
   | eval UniqueID=split(input,",")
   | mvexpand UniqueID | table UniqueID]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

(You will need to replace the first two lines of the search query with something like: index=something sourcetype=something...)

When my user input is "11111,67543,22222" then it will show the "aaa.bbb.ccc.12345.dddddd.ccccc" event.

0 Karma

Kwip
Contributor

Thank you for the immediate response @whrg. This query limiting the numbers to 3. I need it depends on the user input.

0 Karma

naidunath
Observer

Hi All

I have "Text Panel" on dashboard, which is created to filter results with "file name". So if I give single file name it is working fine. But I am looking for multiple inputs like "filename01.txt , filename02.pdf", then it should give the table output on dashboard.

Please help how can I configure or write a code for "Text Panel" to get correct results.

Thanks & Regards

Raghu

 

0 Karma

naidunath
Observer

Please see the screen shot "File Name", need the help on that. 

naidunath_0-1624362947376.png

 

 

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...