Dashboards & Visualizations

Using a single token to search multiple fields from a csv file

learningsplunk
Path Finder

I have a dashboard that's similar to this, however i'm running into a problem...

Is it possible to use a single token (Text token) to search multiple fields at once ?

 

For example from the csv file

 

StocktickerStockDescriptionStock PriceCompanyName
JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
FINCGoods5.12Food. Inc

 

user puts in : "Co"  in the token field  and their return fields are : 

JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
    

 

Is there a way to search Multiple fields with one single token and match that  token's value to those multiple fields  to return their respective rows ?

<form>
<label>Stocks dashboard</label>
<description>Stocks dashboard</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="Stocks">
<label>Put Stock ID here</label>
<initialValue>*StockTicker*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Stocks</title>
<table>
<title>Stocks</title>
<search>
<query>| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$ </query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<refresh>10m</refresh>
<refreshType>delay</refreshType>
</search>
<option name="count">100</option>
<option name="drilldown">cell</option>
<option name="refresh.display">preview</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>

 

 The query :  | inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName|Search Stockticker=$Stocks$ |Search StockDescription=$Stocks$|Search CompanyName=$Stocks$  

 

Issue is that the token only searches for the first field that is given  which is  : Stockticker=$Stocks$ .... so if a user puts Co into the input.....they only get this for the return : 

StocktickerStockDescriptionStock PriceCompanyName
COFood 2Carpy Oscar

 

What the user should be getting when using the dashboard to search: 

JMSFood1JM Smucker Co
COFood 2Carpy Oscar
CSSConsumer goods2.40Consumer Staples Select Sector SPDR ETF (XLP)
    

 

Is there a way to do that through a csv file for a splunk query? 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When one search command pipes to another, the second search only sees those events that matched the first search.  To search multiple fields, use OR within a single search.

 

| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName
| search Stockticker=$Stocks$ OR StockDescription=$Stocks$ OR CompanyName=$Stocks$  

 

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When one search command pipes to another, the second search only sees those events that matched the first search.  To search multiple fields, use OR within a single search.

 

| inputlookup Stocks.csv|table Stockticker,StockDescription,"Stock Price",CompanyName
| search Stockticker=$Stocks$ OR StockDescription=$Stocks$ OR CompanyName=$Stocks$  

 

 

---
If this reply helps you, Karma would be appreciated.

learningsplunk
Path Finder

Perfect ! This works without any issues.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...