Dashboards & Visualizations

How to edit my XML for drop-down inputs to properly filter on expected field values?

fmpa_isaac
Path Finder

I have an issue with my drop-down inputs in my dashboard. If I select a dest port 80 from my list, I expect to only see dest port 80 in my results. However, it's also filtering on the source port 80. How can I stop this behavior, because it's occurring in other dashboards that I have?

 </input>
    <input type="multiselect" token="Dest_Port" searchWhenChanged="true">
      <label>Select a Dest Port:</label>
      <search>
        <query>sourcetype="udp:514" host="172.20.1.62" | stats values(Dest_Port) as Dest_Port | mvexpand Dest_Port | sort Dest_Port</query>
      </search>
      <fieldForLabel>Dest_Port</fieldForLabel>
      <fieldForValue>Dest_Port</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
    <input type="dropdown" token="URL" searchWhenChanged="true">
      <label>Select URL</label>
      <search>
        <query>sourcetype="udp:514" host="172.20.1.62" | stats values(URL) as URL | mvexpand URL | sort URL</query>
      </search>
      <fieldForLabel>URL</fieldForLabel>
      <fieldForValue>URL</fieldForValue>
      <choice value="*">All</choice>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>sourcetype="udp:514" host="172.20.1.62" $User$ $Action$ $Src_IP$ $Dest_IP$ $Dest_Port$ $URL$ | table _time, User, Src_IP, Src_Port, Dest_IP, Dest_Port, Rule_Action, URL</query>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">100</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

in your search I don't see anything before $Dest_Port$ and In your dropdown input there isn't the prefix; in this way you don't use the field and the search is limited to the string from the dropdown.
You should use a prefix in the dropdown input as the following

<prefix>Dest_Port="</prefix>
<suffix>"</suffix>

or in the search you shoud insert:
Dest_Port="$Dest_Port$" instead of $Dest_Port$.

Bye.
Giuseppe

View solution in original post

0 Karma

sundareshr
Legend

Try adding fieldnames to each. Like this (adjust for correct field names)

sourcetype="udp:514" host="172.20.1.62" User="$User$" Action="$Action$" Src_IP="$Src_IP$" Dest_IP="$Dest_IP$"  Dest_Post="$Dest_Port$" URL=" $URL$" | table _time, User, Src_IP, Src_Port, Dest_IP, Dest_Port, Rule_Action, URL
0 Karma

fmpa_isaac
Path Finder

Thank you!

0 Karma

gcusello
SplunkTrust
SplunkTrust

in your search I don't see anything before $Dest_Port$ and In your dropdown input there isn't the prefix; in this way you don't use the field and the search is limited to the string from the dropdown.
You should use a prefix in the dropdown input as the following

<prefix>Dest_Port="</prefix>
<suffix>"</suffix>

or in the search you shoud insert:
Dest_Port="$Dest_Port$" instead of $Dest_Port$.

Bye.
Giuseppe

0 Karma

fmpa_isaac
Path Finder

Thank you!

0 Karma

fmpa_isaac
Path Finder

Also, what I am seeing is that it looks for the value of what I am searching for all throughout the raw data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...