- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- How to split token value and search new values in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
On a dashboard, in a text field box, I would like to be able to give a list of servers in the following format:
server1,server2,server3,server4 etc...
Is it possible to split this list, do a search on a lookuptable and return information for these servers?
For example, the search would be:
|inputlookup ServerInfo.csv
|search HostName=server1 OR HostName=server2 OR HostName=server3 OR HostName=server4
I hope that makes sense
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@baty0 ,
Try below. You need to change the html panel to adapt your dashboard panels.
<form>
<label>Token Split</label>
<fieldset submitButton="false">
<input type="text" token="server_names">
<label>Server Name</label>
<change>
<eval token="splitted_search">"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"</eval>
</change>
</input>
</fieldset>
<row>
<html>
<h1>|inputlookup ServerInfo.csv|search $splitted_search$</h1>
</html>
</row>
</form>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@baty0 ,
Try below. You need to change the html panel to adapt your dashboard panels.
<form>
<label>Token Split</label>
<fieldset submitButton="false">
<input type="text" token="server_names">
<label>Server Name</label>
<change>
<eval token="splitted_search">"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"</eval>
</change>
</input>
</fieldset>
<row>
<html>
<h1>|inputlookup ServerInfo.csv|search $splitted_search$</h1>
</html>
</row>
</form>
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks you so much for your answer, that worked!
I have one last question.
Would it be possible to detect if there is a space between the server name and make the search still work.
For example:
server1, server2, server3, server4
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
you shall remove the space, Please use below
"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"
Updated the answer with the change. Please upvote if it helps!
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're a legend! Thanks
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
