Dashboards & Visualizations

How do you create a Splunk Dashboard input which allows users to select fields to filter and conditions to filter?

rijutha
Explorer

I have a search dashboard to search the KV Store based on a set of fields.

Lets say: FieldA FieldB FieldC FieldD FieldE ... FieldP

The user wants to filter only by FieldA and FieldB with FieldA=12 AND FieldB!=OTHER.

My search query in the panel will be | inputlookup mykv where FieldA=*12* AND

FieldB!=OTHER

If the user wants to filter by FieldE=* AND FieldO=*OTHER*, then my query should change to | inputlookup mykv where FieldE=* AND FieldO=*OTHER*

What I have done is to have drop downs for each field where the user can select if he wants to search by "contains" or "not contains" like below.

The text boxes to enter the string they would want to search on.

The challenge is: how do i consolidate the tokens for all the text boxes that have a value and create by where condition that can be replaced in my table query with a single token that says for e.g., $query$?

Would be great if somebody can help me with this. Thank you in advance.

alt text

alt text

0 Karma

HiroshiSatoh
Champion

Try this!

xml sample
  <fieldset submitButton="false">
    <input type="radio" token="con">
      <label>con</label>
      <choice value="=">contains</choice>
      <choice value="!=">not contains</choice>
    </input>
    <input type="text" token="FieldA">
      <label>FieldA</label>
    </input>
  </fieldset>

search sample
 (your  search) FieldA$con$$FieldA$
0 Karma

rijutha
Explorer

Thanks HiroshiSatoh. How do i do it when I have multiple fields and sometimes the user would filter by fieldA and sometimes by fieldB? and sometimes by both.

0 Karma

HiroshiSatoh
Champion

I think the same is true when using multiple fields, but what's wrong?

(your search) FieldA$con_a$$FieldA$ FieldB$con_b$$FieldB$ FieldC$con_c$$FieldC$

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...