Dashboards & Visualizations

Is it possible to search different products number in splunk dashboard inputs?

saibal6
Path Finder

Hi Everyone,

Recently I’m struggling with a small issue.

I have a Splunk dashboard where I have used Text-box to search a product number in it.

But recently I need to check multiple products number at a same time, because one by one product number search is too much time taking activity.

I have tried to use multi select input feature but somehow it’s not working.

Can someone suggest me a easy and best way to do the same. I have multiple table where I have to check the products number are present or not but need to search multiple products number at a sametime.

Thanks in Advance,
@saibal6

Tags (2)
0 Karma

manjunathmeti
Champion

Provide your comma separated inputs in Text input filter and use same inputs in table query. If product number can be generated by some search query then use multi-select input. Try below example. It contains both text input and multi-select inputs.

<form>
  <label>Test</label>
  <fieldset submitButton="true">
    <input type="text" token="field1">
      <label>Text Input</label>
      <default>LicenseUsage,Metrics</default>
    </input>
    <input type="multiselect" token="field2">
      <label>field2</label>
      <delimiter> </delimiter>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <search>
        <query>index=_internal earliest=-15m | stats count by component</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Result generated by Text Input filter</title>
        <search>
          <query>index=_internal earliest=-15m component IN ($field1$) | stats count by sourcetype, component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <title>Result generated by Multiselect filter</title>
        <search>
          <query>index=_internal earliest=-15m component IN ($field2$) | stats count by sourcetype, component</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

saibal6
Path Finder

my search is look like this :

index=xxxx
| rename xxx as Product_No
| table Product_No
| search Product_No=xxxxx OR Product_No=xxxxx

I can't use simple OR / comma ( , ) in it.

I have to use it like this way. Can you Please help me on that? can you give me an example on this?

0 Karma

efavreau
Motivator

Depending on how you are using your text box, could you put "product1 OR product 2" into the search box and your query would still work?

###

If this reply helps you, an upvote would be appreciated.
0 Karma

saibal6
Path Finder

my search is look like this :

index=xxxx
| rename xxx as Product_No
| table Product_No
| search Product_No=xxxxx OR Product_No=xxxxx

I can't use simple OR / comma ( , ) in it.

I have to use it like this way. Can you Please help me on that?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...