Is it possible to search different products number in splunk dashboard inputs?

[saibal6]

Hi Everyone,

Recently I’m struggling with a small issue.

I have a Splunk dashboard where I have used Text-box to search a product number in it.

But recently I need to check multiple products number at a same time, because one by one product number search is too much time taking activity.

I have tried to use multi select input feature but somehow it’s not working.

Can someone suggest me a easy and best way to do the same. I have multiple table where I have to check the products number are present or not but need to search multiple products number at a sametime.

Thanks in Advance,
@saibal6

[manjunathmeti]

Provide your comma separated inputs in Text input filter and use same inputs in table query. If product number can be generated by some search query then use multi-select input. Try below example. It contains both text input and multi-select inputs.

<form>
  <label>Test</label>
  <fieldset submitButton="true">
    <input type="text" token="field1">
      <label>Text Input</label>
      <default>LicenseUsage,Metrics</default>
    </input>
    <input type="multiselect" token="field2">
      <label>field2</label>
      <delimiter> </delimiter>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal earliest=-15m | stats count by component</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Result generated by Text Input filter</title>
        <search>
          <query>index=_internal earliest=-15m component IN ($field1$) | stats count by sourcetype, component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Result generated by Multiselect filter</title>
        <search>
          <query>index=_internal earliest=-15m component IN ($field2$) | stats count by sourcetype, component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

[saibal6]

my search is look like this :

index=xxxx
| rename xxx as Product_No
| table Product_No
| search Product_No=xxxxx OR Product_No=xxxxx

I can't use simple OR / comma ( , ) in it.

I have to use it like this way. Can you Please help me on that? can you give me an example on this?

[efavreau]

Depending on how you are using your text box, could you put "product1 OR product 2" into the search box and your query would still work?

[saibal6]

my search is look like this :

index=xxxx
| rename xxx as Product_No
| table Product_No
| search Product_No=xxxxx OR Product_No=xxxxx

I can't use simple OR / comma ( , ) in it.

I have to use it like this way. Can you Please help me on that?