how to add a search box on a dashboard

[japposadas]

Hi Splunkers, I just wanna ask if anyone has done this. I wanted to a add splunk search bar like this to my dashboard.

how to add it? Do I need to add it by using script or i just need to call it? thanks in advance!

[mayurr98]

hey try this run anywhere XML

<form>
  <label>Text Form Input Element</label>
  <description>Set search terms by populating a form with textbox input.</description>
  <fieldset autoRun="true" submitButton="true">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="keyword" searchWhenChanged="true">
      <label>Enter Text</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>raw logs for $keyword$</title>
        <search>
          <query>index=_internal $keyword$</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

For example. you can try searching for ERROR keyword in your _internal logs

let me know if this helps !

[493669]

Hi @japposadas,
You can add text input and set a token for it as below:

<input type="text" token="tokenname" searchWhenChanged="true">
   <label>Enter a search</label>
   <suffix></suffix>
 </input>
     </fieldset>

 <panel>
   <table>
     <search>
       <query>index="indexname"  field=$tokenname$ 
       </query>
     </search>

use the $tokenname$ token in your search as required.
Hope this helps.