Dashboards & Visualizations

Using a single token to search multiple fields from a csv file

learningsplunk
Path Finder

I have a dashboard that's similar to this, however i'm running into a problem...

Is it possible to use a single token (Text token) to search multiple fields at once ?

 

For example from the csv file

 

StocktickerStockDescriptionStock PriceCompanyName
JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
FINCGoods5.12Food. Inc

 

user puts in : "Co"  in the token field  and their return fields are : 

JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
    

 

Is there a way to search Multiple fields with one single token and match that  token's value to those multiple fields  to return their respective rows ?

<form>
<label>Stocks dashboard</label>
<description>Stocks dashboard</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="Stocks">
<label>Put Stock ID here</label>
<initialValue>*StockTicker*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Stocks</title>
<table>
<title>Stocks</title>
<search>
<query>| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<option name="refresh.display">preview</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>

 

 The query :  | inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$  

 

Issue is that the token only searches for the first field that is given  which is  : Stockticker=$Stocks$ .... so if a user puts Co into the input.....they only get this for the return : 

StocktickerStockDescriptionStock PriceCompanyName
COFood 2Carpy Oscar

 

What the user should be getting when using the dashboard to search: 

JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
    

 

Is there a way to do that through a csv file for a splunk query? 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When one search command pipes to another, the second search only sees those events that matched the first search.  To search multiple fields, use OR within a single search.

 

| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName
| search Stockticker=$Stocks$ OR StockDescription=$Stocks$ OR CompanyName=$Stocks$  

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When one search command pipes to another, the second search only sees those events that matched the first search.  To search multiple fields, use OR within a single search.

 

| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName
| search Stockticker=$Stocks$ OR StockDescription=$Stocks$ OR CompanyName=$Stocks$  

 

 

---
If this reply helps you, Karma would be appreciated.

learningsplunk
Path Finder

Perfect ! This works without any issues.

Tags (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...