Dashboards & Visualizations

populate dropdown with meta search on tags ?

sbsbb
Builder

I'm able to make a metasearch on sources for example, but is it also possible to make one on tags, so I could populate a dropdown with the tags I've defined ?

sideview
SplunkTrust
SplunkTrust

You can by using the rest search command. Your users might need admin privileges to run the rest command, but this would work:

| rest /services/search/tags

Here's a really simple self-contained example using Sideview Utils modules to present a simple interface where you can search on one tag at a time and look at the events. Should give you some good ideas.

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| rest /services/search/tags | fields title</param>

  <module name="Pulldown">
    <param name="name">tag</param>
    <param name="label">Search on a tag:</param>
    <param name="valueField">title</param>
    <param name="template">tag::$value$</param>

    <module name="Search">
      <param name="search">$tag$ | head 1000 </param>

      <module name="Events"></module>
    </module>
  </module>
</module>

Note you would need the latest Sideview Utils app from the Sideview site to run this example ( http://sideviewapps.com ) .

sideview
SplunkTrust
SplunkTrust

Unfortunately my answer may have been a bit too optimistic. I looked into it a bit more, and there are some problems. One problem is that /services/search/tags will only get tags that have been exported to system level. If you want the ones that are still in an app, you need to pick an app, AND pick a username -- "/servicesNS///data/tags". While there are ways to filter them by what fields they're tagged on, I think the requirement to pick both app and username probably takes us out of the world of easy UI answers. So actually I don't think there is a good way.

0 Karma

sbsbb
Builder

I want to search tag::host
With your query, I can only see search tags, is this the same command for source and host tags ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...