how to get input from Dashboard to filter the search?

[ramyaashok]

Hi,

I have query like below, and I want to get this data from user for which I have added a input field called Dsn.

Query:
(SourceFile="" OR DestFile="")

here instead of "*", I need to substitute user entered value in the DSN field of UI panel.
Can anyone please help me with this.

Thanks

[steve220]

Im not the OP, but this helped me.

[gcusello]

Hi ramyaashok,
sorry but I cannot find "*" in your query, could you use the "Code Sample" button ("101010" button) to highlight you query?

Anyway, if I correctly understood, you have to insert and input field (e.g. a free text but it could be also a dropdown or a multichoice) and than use this token in your search.
So, if your token is called "user", you should try something like this:
In the fieldset section

<fieldset autoRun="true" submitButton="false">
        <input type="text" token="user" searchWhenChanged="true">
            <label>Enter a username:</label>
            <default>*</default>
        </input>
    </fieldset>

in the search

index=my_index (SourceFile="" OR DestFile="") user=$user$
| ...

I suggest to see the Splunk Dashboard Examples App ( https://splunkbase.splunk.com/app/1603/ ) where you can find many useful examples.

Bye.
Giuseppe

[ramyaashok]

Thanks Giuseppe,

sorry for inadequate information. Actually, my input must be given in as "text" and that value must be substituted to both source file and destination file.
for eg: if the input am giving is "peacock" this value should be given to both source file and destination file,
like: index=my_index (sourcefile="peacock" OR destinationfile="peacock") .
hope this explains it clearly.

[gcusello]

Hi ramyaashok,
see the Example App to learn how to filter your results.
Anyway, if your token is named "user" try:

 index=my_index (SourceFile="$user$" OR DestFile="$user$") 
| ...

if the token is only a part of the field, you can use wildcards, but it's slower:

 index=my_index (SourceFile="*$user$*" OR DestFile="*$user$*") 
| ...

Bye.
Giuseppe

[gcusello]

Hi ramyaashok,
if you're satisfied by my answer, please, accept and(ot upvote it.
Bye, see next time.
Giuseppe