create a dashbord and use text field to search mul...

haddad · ‎08-26-2018

hello all

i have created a dashboard for nessus report. the results are huge thus our users need to exclude some results

for example they need to exclude ssh and telnet vulnerability reports so they need a text field to type it and then in the background use as filed1!=ssh AND field2!=telnet.

my question is how to deploy this ? with only one input field and just type the string like " ssh telnet "

it it possible ? or any other solution ?

renjith_nair · ‎08-27-2018

@haddad,

Try this

<form>
  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="searchFilter">
      <label>Filter</label>
    </input>
  </fieldset>
  <search>
      <query>|stats count|eval s=split("$searchFilter$"," ")|fields s| eval x=mvjoin(s,",")|fields x</query>
      <done>
        <set token="finalFilter">$result.x$</set>
      </done>
  </search>  
  <row>
    <html>
      <h1>your final search |search NOT field IN ($finalFilter$)</h1>
    </html>
  </row>
</form>

---
What goes around comes around. If it helps, hit it with Karma 🙂

create a dashbord and use text field to search multi string

Can’t make it to .conf25? Join us online!

Community Content Calendar, September edition

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you a member of the Splunk Community?

create a dashbord and use text field to search multi string

Can’t make it to .conf25? Join us online!

Community Content Calendar, September edition

Splunkbase Unveils New App Listing Management Public Preview

Leveraging Automated Threat Analysis Across the Splunk Ecosystem