Dashboards & Visualizations

Using a single token to search multiple fields from a csv file

learningsplunk
Path Finder

I have a dashboard that's similar to this, however i'm running into a problem...

Is it possible to use a single token (Text token) to search multiple fields at once ?

 

For example from the csv file

 

StocktickerStockDescriptionStock PriceCompanyName
JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
FINCGoods5.12Food. Inc

 

user puts in : "Co"  in the token field  and their return fields are : 

JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
    

 

Is there a way to search Multiple fields with one single token and match that  token's value to those multiple fields  to return their respective rows ?

<form>
<label>Stocks dashboard</label>
<description>Stocks dashboard</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="Stocks">
<label>Put Stock ID here</label>
<initialValue>*StockTicker*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Stocks</title>
<table>
<title>Stocks</title>
<search>
<query>| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<option name="refresh.display">preview</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>

 

 The query :  | inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$  

 

Issue is that the token only searches for the first field that is given  which is  : Stockticker=$Stocks$ .... so if a user puts Co into the input.....they only get this for the return : 

StocktickerStockDescriptionStock PriceCompanyName
COFood 2Carpy Oscar

 

What the user should be getting when using the dashboard to search: 

JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
    

 

Is there a way to do that through a csv file for a splunk query? 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When one search command pipes to another, the second search only sees those events that matched the first search.  To search multiple fields, use OR within a single search.

 

| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName
| search Stockticker=$Stocks$ OR StockDescription=$Stocks$ OR CompanyName=$Stocks$  

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When one search command pipes to another, the second search only sees those events that matched the first search.  To search multiple fields, use OR within a single search.

 

| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName
| search Stockticker=$Stocks$ OR StockDescription=$Stocks$ OR CompanyName=$Stocks$  

 

 

---
If this reply helps you, Karma would be appreciated.

learningsplunk
Path Finder

Perfect ! This works without any issues.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...