Dashboards & Visualizations

How to add a text box in a dashboard?

ASISH_9
Engager

I have a dashboard which has a filter. In the filter, there are around 7 reports and by passing the token in the search string, we can reload the reports in the dashboard. I also need a text box in which if i type something which is related to a particular report, then that should be shown in the dashboard.

Say there is a report named EmployeeReport, if i type Employee=A*, then all the names starting with A should be displayed. Another report named organization, if i type Org.=A* then all organizations starting with letter A will be displayed. Here Employee and Org are header fields in their respective reports. Initially the dashboard is blank, the moment one selects something in the Dropdown, then the dashboard will be reloaded. So how can i bring this text box and link it with the dashboard?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You can add text box and include the token in your search

eg:

<form>
  <label>test</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype" searchWhenChanged="false">
      <label>Sourcetype</label>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search>
        <query>index=_internal|stats count by sourcetype</query>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </search>
      <choice value="*">All</choice>
    </input>
    <input type="text" token="srch">
      <label>Search</label>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal sourcetype="$sourcetype$" source="*$srch$*"|table host,source,sourcetype</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!
0 Karma

ASISH_9
Engager

Hello @renjith.nair , if I add this to my xml and I type "Employee=*" in the text box then no results are coming.Further when I validated the query,the query came out to be something like this

MyQuery|serach Text="Employee=*"

and no reults are being displayed.If any other means you can suggest.
Thanks by the way

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

As you might have figured out, above was just an example .
You search which displays in the panel should have a column Employee and then add the token to this search.
MyQuery Employee=$textboxtoken$

Is it possible to paste your xml ?

Happy Splunking!
0 Karma

ASISH_9
Engager

Hello renjith.nair , if I add this in my xml and in the text box if I type Employee=*,then no resuls are coming.In the searh query it is displaying something like this

MyQuery|search Text="Employee=*"|

and no results are coming

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...