Dashboards & Visualizations

populate dropdown with meta search on tags ?

sbsbb
Builder

I'm able to make a metasearch on sources for example, but is it also possible to make one on tags, so I could populate a dropdown with the tags I've defined ?

sideview
SplunkTrust
SplunkTrust

You can by using the rest search command. Your users might need admin privileges to run the rest command, but this would work:

| rest /services/search/tags

Here's a really simple self-contained example using Sideview Utils modules to present a simple interface where you can search on one tag at a time and look at the events. Should give you some good ideas.

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| rest /services/search/tags | fields title</param>

  <module name="Pulldown">
    <param name="name">tag</param>
    <param name="label">Search on a tag:</param>
    <param name="valueField">title</param>
    <param name="template">tag::$value$</param>

    <module name="Search">
      <param name="search">$tag$ | head 1000 </param>

      <module name="Events"></module>
    </module>
  </module>
</module>

Note you would need the latest Sideview Utils app from the Sideview site to run this example ( http://sideviewapps.com ) .

sideview
SplunkTrust
SplunkTrust

Unfortunately my answer may have been a bit too optimistic. I looked into it a bit more, and there are some problems. One problem is that /services/search/tags will only get tags that have been exported to system level. If you want the ones that are still in an app, you need to pick an app, AND pick a username -- "/servicesNS///data/tags". While there are ways to filter them by what fields they're tagged on, I think the requirement to pick both app and username probably takes us out of the world of easy UI answers. So actually I don't think there is a good way.

0 Karma

sbsbb
Builder

I want to search tag::host
With your query, I can only see search tags, is this the same command for source and host tags ?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...