Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Using text imput to complete a search string in a ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello everyone I hope you guys are doing very well,
I am trying to create my very first dashboard and I have to run a code like this one:
index=rent_hotel AND "VOUCHER-56IX75"
| stats values(CLIENT) as ID by tx_uner_rep
this code will generate a table but... I want to create a dashboard that will allow me to perform this search by having a text input field where I can enter a string that will change the "VOUCHER-" portion for whatever string I submit lets say if I put "893YX" I want the code to run:
index=rent_hotel AND "VOUCHER-893YX"
| stats values(CLIENT) as ID by tx_uner_rep
and I want my dashboard the generate results only after I click on the submit button... I have tried all day without any luck by the way I using the normal/clasic version of dashboard.. I will really be so thankful if you guys can reference some links on how to achieve this thank you very much
Kindly,
Cindy
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here's an example dashboard
<form>
<label>vouchers</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="voucher_id">
<label>VoucherId</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
index=rent_hotel AND "VOUCHER-$voucher_id$"
| stats values(CLIENT) as ID by tx_uner_rep
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<html>
<h1>Query being run</h1>
index=rent_hotel AND "VOUCHER-$voucher_id$"<br/>
| stats values(CLIENT) as ID by tx_uner_rep
</html>
</panel>
</row>
</form>and token usage docs are here
https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/tokens
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you please try this?
<form>
<label>Example</label>
<fieldset submitButton="false" autoRun="false">
<input type="text" token="tkn_input">
<label>input</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=rent_hotel AND "VOUCHER-$tkn_input$"
| stats values(CLIENT) as ID by tx_uner_rep</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>
Please refer below links to get more on it.
https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/BuildandeditdashboardswithSimplifiedXML
https://docs.splunk.com/Documentation/SplunkCloud/8.2.2104/Viz/CreateDashboards
https://www.splunk.com/pdfs/solution-guides/splunk-dashboards-quick-reference-guide.pdf
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here's an example dashboard
<form>
<label>vouchers</label>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="voucher_id">
<label>VoucherId</label>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>
index=rent_hotel AND "VOUCHER-$voucher_id$"
| stats values(CLIENT) as ID by tx_uner_rep
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">row</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<html>
<h1>Query being run</h1>
index=rent_hotel AND "VOUCHER-$voucher_id$"<br/>
| stats values(CLIENT) as ID by tx_uner_rep
</html>
</panel>
</row>
</form>and token usage docs are here
https://docs.splunk.com/Documentation/Splunk/8.2.0/Viz/tokens
Index This | When is October more than just the tenth month?
Observe and Secure All Apps with Splunk
What’s New & Next in Splunk SOAR
