Dashboards & Visualizations

How to create a text box using condition

hrs2019
Path Finder

Hello

How to create the text box with the condition for Accepting user input only if the URL starts from https://somthinglike.com.
if any user enters www.facebook.com it ll not consider or save to the text box because https is missing.
Need to implement
1.URL condition.
2. Only 5 URL allow
Below is the screenshort
textbox.JPG

Labels (1)
0 Karma
1 Solution

niketn
Legend

@hrs2019 you can use an independent search to pass the URLs from text box to SPL and process to validate whether it matches your Upto 5 URL criteria and all URL beginning with https criteria.

Screen Shot 2020-07-18 at 3.35.45 AM.png

 

Screen Shot 2020-07-18 at 3.36.03 AM.png

 

Screen Shot 2020-07-18 at 3.36.38 AM.png

 

Screen Shot 2020-07-18 at 3.36.50 AM.png

 

Following is a run anywhere sample dashboard for above example. Please try out and confirm!

<form>
  <label>Text Box Validation</label>
  <search>
    <query>| makeresults
      | eval url="$url$"
      | eval url_count=split(trim(url),",")
      | rex field=url "(?&lt;url_type&gt;(https|http))" max_match=0
      | eval boolValidationURLCount=case(mvcount(url_count)&lt;=5,"true",true(),"false")
      | eval boolValidationURLCondition=case(url_type="https" AND url_type!="http","true",true(),"false")</query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidURLs">$result.url$</set>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed. URL must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed.</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">URLs must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="splunk_input_text_url" type="text" token="url" searchWhenChanged="true">
      <label>Enter Upto 5 URLs (https ONLY)</label>
      <default>https://www.facebook.com,https://www.gmail.com,https://www.amazon.com;https://www.splunk.com,https://yahoo.com,https://se.ccp.com</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html rejects="$tokValidURLs$">
        <style>
          #splunk_input_text_url{
            width: 1220px !important;
          }
        </style>
        <div>
          <b style="color:red">$tokValidationError$.</b>
        </div>
        <div>
          Please validate input <b style="color:red">$url$</b>!!!
        </div>
      </html>
      <table depends="$tokValidURLs$">
        <title>Table with valid URLs</title>
        <search depends="$tokValidURLs$">
          <query>| makeresults 
| fields - _time 
| eval URL="$tokValidURLs$" 
| makemv URL delim="," 
| mvexpand URL 
| rex field=URL "(?&lt;URL_Type&gt;(https|http))"
| table URL, URL_Type</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@hrs2019 you can use an independent search to pass the URLs from text box to SPL and process to validate whether it matches your Upto 5 URL criteria and all URL beginning with https criteria.

Screen Shot 2020-07-18 at 3.35.45 AM.png

 

Screen Shot 2020-07-18 at 3.36.03 AM.png

 

Screen Shot 2020-07-18 at 3.36.38 AM.png

 

Screen Shot 2020-07-18 at 3.36.50 AM.png

 

Following is a run anywhere sample dashboard for above example. Please try out and confirm!

<form>
  <label>Text Box Validation</label>
  <search>
    <query>| makeresults
      | eval url="$url$"
      | eval url_count=split(trim(url),",")
      | rex field=url "(?&lt;url_type&gt;(https|http))" max_match=0
      | eval boolValidationURLCount=case(mvcount(url_count)&lt;=5,"true",true(),"false")
      | eval boolValidationURLCondition=case(url_type="https" AND url_type!="http","true",true(),"false")</query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidURLs">$result.url$</set>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed. URL must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed.</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">URLs must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="splunk_input_text_url" type="text" token="url" searchWhenChanged="true">
      <label>Enter Upto 5 URLs (https ONLY)</label>
      <default>https://www.facebook.com,https://www.gmail.com,https://www.amazon.com;https://www.splunk.com,https://yahoo.com,https://se.ccp.com</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html rejects="$tokValidURLs$">
        <style>
          #splunk_input_text_url{
            width: 1220px !important;
          }
        </style>
        <div>
          <b style="color:red">$tokValidationError$.</b>
        </div>
        <div>
          Please validate input <b style="color:red">$url$</b>!!!
        </div>
      </html>
      <table depends="$tokValidURLs$">
        <title>Table with valid URLs</title>
        <search depends="$tokValidURLs$">
          <query>| makeresults 
| fields - _time 
| eval URL="$tokValidURLs$" 
| makemv URL delim="," 
| mvexpand URL 
| rex field=URL "(?&lt;URL_Type&gt;(https|http))"
| table URL, URL_Type</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

hrs2019
Path Finder

Hi, @niketn Thank You so much for your solution.
Actually I am getting one issue that needs your help.
While entering the URL 1 it shows URL1 in the panel which is correct, but while entering URL 2 it shows only Url 2, ideally it has to show both the URLs.
This is applicable for 5 URLs as we have set the condition.
If any URL is missing https//: it ll not allow and ll not display in the panel.
Can you please help me to fix this. I have added the screenshot for more info.
URL1.JPG

0 Karma

niketn
Legend

Based on the original ask, my intent was to show you how to use the SPL to perform validations you need. I would expect you to incorporate any further validations as per your needs. I am not sure why you want to treat a URL without https and http as valid URL. Nevertheless take advantage of SPL and add as many validations you need!

Do upvote the answers that helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...