Dashboards & Visualizations

Search by user request parameter in Splunk Dashboard

gauravepi
Path Finder

I have a event created which is returning Jason data after search :

eventtype="my_new"

Data returned after this search :

data: {"Id":2001373223232214,"SerialNumber":6773737,"Unique":"200000","messageType":"READY","activeStartTime":"2018-08-29T09:30:00.000-0500","activeEndTime":"2018-08-30T11:00:00.000-0500","additional":["fitness","pool","public"],}

Now i want to give a feature on dashboard to the user if to search whole message by passing Unique number in a search box. I have no clue how we can do this in Splunk . Please help me in this

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@gauravepi ,
Are you looking for something similar ?

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="tok_unique">
      <label>Unique</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <!--Dummy Data Creation-->
          <query>|makeresults|eval json="{\"data\": 
            {
             \"Id\":2001373223232214,
             \"SerialNumber\":6773737,
             \"Unique\":\"200000\",
             \"messageType\":\"READY\",
             \"activeStartTime\":\"2018-08-29T09:30:00.000-0500\",
             \"activeEndTime\":\"2018-08-30T11:00:00.000-0500\",
             \"additional\":[\"fitness\",\"pool\",\"public\"]
             }
             }"|append [|makeresults|eval json="{\"data\": 
            {
             \"Id\":2001373223232314,
             \"SerialNumber\":6773737,
             \"Unique\":\"300000\",
             \"messageType\":\"READY\",
             \"activeStartTime\":\"2018-08-29T09:30:00.000-0500\",
             \"activeEndTime\":\"2018-08-30T11:00:00.000-0500\",
             \"additional\":[\"fitness\",\"pool\",\"public\"]
             }
             }"]
            |spath input=json output=unique path=data.Unique|search unique="$tok_unique$" |fields json</query>
          <earliest>-1m</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

gauravepi
Path Finder

Yes i was looking for this . How we can do this from UI panel. Do you have information regarding that.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

I did the above using UI panel or what exactly you mean?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...