Dashboards & Visualizations

populate dropdown with meta search on tags ?

sbsbb
Builder

I'm able to make a metasearch on sources for example, but is it also possible to make one on tags, so I could populate a dropdown with the tags I've defined ?

sideview
SplunkTrust
SplunkTrust

You can by using the rest search command. Your users might need admin privileges to run the rest command, but this would work:

| rest /services/search/tags

Here's a really simple self-contained example using Sideview Utils modules to present a simple interface where you can search on one tag at a time and look at the events. Should give you some good ideas.

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| rest /services/search/tags | fields title</param>

  <module name="Pulldown">
    <param name="name">tag</param>
    <param name="label">Search on a tag:</param>
    <param name="valueField">title</param>
    <param name="template">tag::$value$</param>

    <module name="Search">
      <param name="search">$tag$ | head 1000 </param>

      <module name="Events"></module>
    </module>
  </module>
</module>

Note you would need the latest Sideview Utils app from the Sideview site to run this example ( http://sideviewapps.com ) .

sideview
SplunkTrust
SplunkTrust

Unfortunately my answer may have been a bit too optimistic. I looked into it a bit more, and there are some problems. One problem is that /services/search/tags will only get tags that have been exported to system level. If you want the ones that are still in an app, you need to pick an app, AND pick a username -- "/servicesNS///data/tags". While there are ways to filter them by what fields they're tagged on, I think the requirement to pick both app and username probably takes us out of the world of easy UI answers. So actually I don't think there is a good way.

0 Karma

sbsbb
Builder

I want to search tag::host
With your query, I can only see search tags, is this the same command for source and host tags ?

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...