Dashboards & Visualizations

How to create a text box using condition

hrs2019
Path Finder

Hello

How to create the text box with the condition for Accepting user input only if the URL starts from https://somthinglike.com.
if any user enters www.facebook.com it ll not consider or save to the text box because https is missing.
Need to implement
1.URL condition.
2. Only 5 URL allow
Below is the screenshort
textbox.JPG

Labels (1)
0 Karma
1 Solution

niketn
Legend

@hrs2019 you can use an independent search to pass the URLs from text box to SPL and process to validate whether it matches your Upto 5 URL criteria and all URL beginning with https criteria.

Screen Shot 2020-07-18 at 3.35.45 AM.png

 

Screen Shot 2020-07-18 at 3.36.03 AM.png

 

Screen Shot 2020-07-18 at 3.36.38 AM.png

 

Screen Shot 2020-07-18 at 3.36.50 AM.png

 

Following is a run anywhere sample dashboard for above example. Please try out and confirm!

<form>
  <label>Text Box Validation</label>
  <search>
    <query>| makeresults
      | eval url="$url$"
      | eval url_count=split(trim(url),",")
      | rex field=url "(?&lt;url_type&gt;(https|http))" max_match=0
      | eval boolValidationURLCount=case(mvcount(url_count)&lt;=5,"true",true(),"false")
      | eval boolValidationURLCondition=case(url_type="https" AND url_type!="http","true",true(),"false")</query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidURLs">$result.url$</set>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed. URL must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed.</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">URLs must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="splunk_input_text_url" type="text" token="url" searchWhenChanged="true">
      <label>Enter Upto 5 URLs (https ONLY)</label>
      <default>https://www.facebook.com,https://www.gmail.com,https://www.amazon.com;https://www.splunk.com,https://yahoo.com,https://se.ccp.com</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html rejects="$tokValidURLs$">
        <style>
          #splunk_input_text_url{
            width: 1220px !important;
          }
        </style>
        <div>
          <b style="color:red">$tokValidationError$.</b>
        </div>
        <div>
          Please validate input <b style="color:red">$url$</b>!!!
        </div>
      </html>
      <table depends="$tokValidURLs$">
        <title>Table with valid URLs</title>
        <search depends="$tokValidURLs$">
          <query>| makeresults 
| fields - _time 
| eval URL="$tokValidURLs$" 
| makemv URL delim="," 
| mvexpand URL 
| rex field=URL "(?&lt;URL_Type&gt;(https|http))"
| table URL, URL_Type</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@hrs2019 you can use an independent search to pass the URLs from text box to SPL and process to validate whether it matches your Upto 5 URL criteria and all URL beginning with https criteria.

Screen Shot 2020-07-18 at 3.35.45 AM.png

 

Screen Shot 2020-07-18 at 3.36.03 AM.png

 

Screen Shot 2020-07-18 at 3.36.38 AM.png

 

Screen Shot 2020-07-18 at 3.36.50 AM.png

 

Following is a run anywhere sample dashboard for above example. Please try out and confirm!

<form>
  <label>Text Box Validation</label>
  <search>
    <query>| makeresults
      | eval url="$url$"
      | eval url_count=split(trim(url),",")
      | rex field=url "(?&lt;url_type&gt;(https|http))" max_match=0
      | eval boolValidationURLCount=case(mvcount(url_count)&lt;=5,"true",true(),"false")
      | eval boolValidationURLCondition=case(url_type="https" AND url_type!="http","true",true(),"false")</query>
    <earliest>$earliest$</earliest>
    <latest>$latest$</latest>
    <done>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidURLs">$result.url$</set>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed. URL must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;false&quot; AND $result.boolValidationURLCondition$==&quot;true&quot;">
        <set token="tokValidationError">Only upto 5 URLs allowed.</set>
        <unset token="tokValidURLs"></unset>
      </condition>
      <condition match="$result.boolValidationURLCount$==&quot;true&quot; AND $result.boolValidationURLCondition$==&quot;false&quot;">
        <set token="tokValidationError">URLs must start with https</set>
        <unset token="tokValidURLs"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="splunk_input_text_url" type="text" token="url" searchWhenChanged="true">
      <label>Enter Upto 5 URLs (https ONLY)</label>
      <default>https://www.facebook.com,https://www.gmail.com,https://www.amazon.com;https://www.splunk.com,https://yahoo.com,https://se.ccp.com</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html rejects="$tokValidURLs$">
        <style>
          #splunk_input_text_url{
            width: 1220px !important;
          }
        </style>
        <div>
          <b style="color:red">$tokValidationError$.</b>
        </div>
        <div>
          Please validate input <b style="color:red">$url$</b>!!!
        </div>
      </html>
      <table depends="$tokValidURLs$">
        <title>Table with valid URLs</title>
        <search depends="$tokValidURLs$">
          <query>| makeresults 
| fields - _time 
| eval URL="$tokValidURLs$" 
| makemv URL delim="," 
| mvexpand URL 
| rex field=URL "(?&lt;URL_Type&gt;(https|http))"
| table URL, URL_Type</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

hrs2019
Path Finder

Hi, @niketn Thank You so much for your solution.
Actually I am getting one issue that needs your help.
While entering the URL 1 it shows URL1 in the panel which is correct, but while entering URL 2 it shows only Url 2, ideally it has to show both the URLs.
This is applicable for 5 URLs as we have set the condition.
If any URL is missing https//: it ll not allow and ll not display in the panel.
Can you please help me to fix this. I have added the screenshot for more info.
URL1.JPG

0 Karma

niketn
Legend

Based on the original ask, my intent was to show you how to use the SPL to perform validations you need. I would expect you to incorporate any further validations as per your needs. I am not sure why you want to treat a URL without https and http as valid URL. Nevertheless take advantage of SPL and add as many validations you need!

Do upvote the answers that helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off

We love our Splunk Community and want you to feel inspired by all your hard work! Eric Fusilero, our VP of ...

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...