Dashboards & Visualizations

how to get input from Dashboard to filter the search?

ramyaashok
New Member

Hi,

I have query like below, and I want to get this data from user for which I have added a input field called Dsn.

Query:
(SourceFile="" OR DestFile="")

here instead of "*", I need to substitute user entered value in the DSN field of UI panel.
Can anyone please help me with this.

Thanks

Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ramyaashok,
sorry but I cannot find "*" in your query, could you use the "Code Sample" button ("101010" button) to highlight you query?

Anyway, if I correctly understood, you have to insert and input field (e.g. a free text but it could be also a dropdown or a multichoice) and than use this token in your search.
So, if your token is called "user", you should try something like this:
In the fieldset section

<fieldset autoRun="true" submitButton="false">
        <input type="text" token="user" searchWhenChanged="true">
            <label>Enter a username:</label>
            <default>*</default>
        </input>
    </fieldset>

in the search

index=my_index (SourceFile="" OR DestFile="") user=$user$
| ...

I suggest to see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ) where you can find many useful examples.

Bye.
Giuseppe

0 Karma

ramyaashok
New Member

Thanks Giuseppe,

sorry for inadequate information. Actually, my input must be given in as "text" and that value must be substituted to both source file and destination file.
for eg: if the input am giving is "peacock" this value should be given to both source file and destination file,
like: index=my_index (sourcefile="peacock" OR destinationfile="peacock") .
hope this explains it clearly.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ramyaashok,
see the Example App to learn how to filter your results.
Anyway, if your token is named "user" try:

 index=my_index (SourceFile="$user$" OR DestFile="$user$") 
| ...

if the token is only a part of the field, you can use wildcards, but it's slower:

 index=my_index (SourceFile="*$user$*" OR DestFile="*$user$*") 
| ...

Bye.
Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi ramyaashok,
if you're satisfied by my answer, please, accept and(ot upvote it.
Bye, see next time.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...