Dashboards & Visualizations

How do I read comma separated inputs from a single text input box in a form?

Contributor

Hi Team,

I am creating a form where a user can input a set of values separated by commas. Below are the details and example.

I need to generate a table with a set of jobs along with some other information.

The job name will have a unique ID. Those IDs will be provided as a comma separated input by the user.

Job_Name=aaa.bbb.ccc.xxxxx(UniqueID).dddddd.ccccc

So, the user input needs to be applied in the Job_Name field in a OR condition. Like below,

Say example user imput is 12345, 09876, 67543

I need to generate a search like index=something sourecetype=something Job_Name=aaa.bbb.ccc.12345.dddddd.ccccc OR aaa.bbb.ccc.09876.dddddd.ccccc OR aaa.bbb.ccc.67543.dddddd.ccccc.

Please help me out on this.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@Kwip

Can you please try this?

<form>
   <label>Job Search</label>
   <fieldset submitButton="false">
     <input type="text" token="input_jobs">
       <label>IDs (comma-separated)</label>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <search>
           <query> index=something sourecetype=something  [| makeresults | eval input="$input_jobs$" | eval Job_Name=split(input,",") | mvexpand Job_Name |eval Job_Name="aaa.bbb.ccc.".Job_Name.".dddddd.ccccc" | table Job_Name  ]   </query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>
   </row>
 </form>

Thanks

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

@Kwip

Can you please try this?

<form>
   <label>Job Search</label>
   <fieldset submitButton="false">
     <input type="text" token="input_jobs">
       <label>IDs (comma-separated)</label>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <search>
           <query> index=something sourecetype=something  [| makeresults | eval input="$input_jobs$" | eval Job_Name=split(input,",") | mvexpand Job_Name |eval Job_Name="aaa.bbb.ccc.".Job_Name.".dddddd.ccccc" | table Job_Name  ]   </query>
           <earliest>-24h@h</earliest>
           <latest>now</latest>
         </search>
         <option name="count">10</option>
         <option name="drilldown">none</option>
         <option name="refresh.display">progressbar</option>
       </table>
     </panel>
   </row>
 </form>

Thanks

View solution in original post

0 Karma

Contributor

Awesomw @kamlesh_vaghela. This is what I am looking for.

0 Karma

SplunkTrust
SplunkTrust

Glad to help you. 🙂
Happy Splunking

0 Karma

Motivator

I think it might be easier in your case to use a subsearch instead of OR conditions.

My idea was to extract the UniqueID from the events in the base search. (You could also use a field extraction instead of the rex command.) The subsearch will then match the UniqueIDs against the user input. Have a look at this dashboard:

<form>
  <label>Job Search</label>
  <fieldset submitButton="false">
    <input type="text" token="input_jobs">
      <label>IDs (comma-separated)</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults count=3 | streamstats count
| eval Job_Name=case(count==1,"aaa.bbb.ccc.12345.dddddd.ccccc",count==2,"aaa.bbb.ccc.09876.dddddd.ccccc",count==3,"aaa.bbb.ccc.67543.dddddd.ccccc")
| rex field=Job_Name "aaa\.bbb\.ccc.(?<UniqueID>[\d]+)"
| search [| makeresults count=1
   | eval input="$input_jobs$"
   | eval input=replace(input," ","")
   | eval UniqueID=split(input,",")
   | mvexpand UniqueID | table UniqueID]</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

(You will need to replace the first two lines of the search query with something like: index=something sourcetype=something...)

When my user input is "11111,67543,22222" then it will show the "aaa.bbb.ccc.12345.dddddd.ccccc" event.

0 Karma

Contributor

Thank you for the immediate response @whrg. This query limiting the numbers to 3. I need it depends on the user input.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!