Dashboards & Visualizations
Highlighted

populate dropdown with meta search on tags ?

Builder

I'm able to make a metasearch on sources for example, but is it also possible to make one on tags, so I could populate a dropdown with the tags I've defined ?

Highlighted

Re: populate dropdown with meta search on tags ?

SplunkTrust
SplunkTrust

You can by using the rest search command. Your users might need admin privileges to run the rest command, but this would work:

| rest /services/search/tags

Here's a really simple self-contained example using Sideview Utils modules to present a simple interface where you can search on one tag at a time and look at the events. Should give you some good ideas.

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| rest /services/search/tags | fields title</param>

  <module name="Pulldown">
    <param name="name">tag</param>
    <param name="label">Search on a tag:</param>
    <param name="valueField">title</param>
    <param name="template">tag::$value$</param>

    <module name="Search">
      <param name="search">$tag$ | head 1000 </param>

      <module name="Events"></module>
    </module>
  </module>
</module>

Note you would need the latest Sideview Utils app from the Sideview site to run this example ( http://sideviewapps.com ) .

Highlighted

Re: populate dropdown with meta search on tags ?

Builder

I want to search tag::host
With your query, I can only see search tags, is this the same command for source and host tags ?

0 Karma
Highlighted

Re: populate dropdown with meta search on tags ?

SplunkTrust
SplunkTrust

Unfortunately my answer may have been a bit too optimistic. I looked into it a bit more, and there are some problems. One problem is that /services/search/tags will only get tags that have been exported to system level. If you want the ones that are still in an app, you need to pick an app, AND pick a username -- "/servicesNS///data/tags". While there are ways to filter them by what fields they're tagged on, I think the requirement to pick both app and username probably takes us out of the world of easy UI answers. So actually I don't think there is a good way.

0 Karma