Getting Data In

Adapt search filter to a query

null0
New Member

Hello,
i need to insert IP addresses here
alt text

coded as follow:

    <input type="text" token="host" searchWhenChanged="false">
      <default>*</default>
    </input>

to be applied to:

| pivot Cisco_IOS_Event Device last(hostname) AS "Hostname" last(site_id) AS "Site ID" last(model) AS "Model" last(serial_number) AS "Serial number" count(Device) AS "Count of events" SPLITROW host AS host

and many others panels. I should need to understand where to insert in panel's queries the referens to search-box posted above.

E.g.:
in this query, search-box works fine and it outputs me only IPs int 10..29.10.x subnet:

| pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Count of Cisco IOS Event" SPLITROW host AS host SPLITCOL severity_id_and_name FILTER host is "$host$" SORT 500 host ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1 | sort -"0 - emergency", -"1 - alert", -"2 - critical", -"3 - error", -"4 - warning", -"5 - notification", -"6 - informational", -"7 - debugging" | table host "0 - emergency" "1 - alert" "2 - critical" "3 - error" "4 - warning" "5 - notification" "6 - informational" "7 - debugging"

Hope to have explaned clearly.

thanks

UPDATE
i'm going to this about this filter could be applied only to PIVOT queries..

because working a little bit more on the previous posted PIVOT query i had successful results.

But e.g. on the following NON-PIVOT query i'm still have issues:

eventtype=cisco_ios-duplex_mismatch | dedup dvc,cdp_local_interface | table _time,dvc,cdp_local_interface,cdp_neighbor,dest_interface,message_text | rename cdp_local_interface AS "Local Int.",cdp_neighbor AS "CDP Neighbor",dest_interface AS "Remote Int.",message_text AS "Message" | sort dvc
0 Karma
1 Solution

niketn
Legend

@null0, what is the definition of your eventtype eventtype=cisco_ios-duplex_mismatch? What is the host fieldname for cisco_ios-duplex_mismatch ? Is it host?

have you tried a filter like the following in your base search with eventtype (where host field name in your raw data is host)?

  eventtype=cisco_ios-duplex_mismatch  host="$host$"
 | dedup dvc,cdp_local_interface 
 | table _time,dvc,cdp_local_interface,cdp_neighbor,dest_interface,message_text 
 | rename cdp_local_interface AS "Local Int.",cdp_neighbor AS "CDP Neighbor",dest_interface AS "Remote Int.",message_text AS "Message" 
 | sort dvc
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@null0, what is the definition of your eventtype eventtype=cisco_ios-duplex_mismatch? What is the host fieldname for cisco_ios-duplex_mismatch ? Is it host?

have you tried a filter like the following in your base search with eventtype (where host field name in your raw data is host)?

  eventtype=cisco_ios-duplex_mismatch  host="$host$"
 | dedup dvc,cdp_local_interface 
 | table _time,dvc,cdp_local_interface,cdp_neighbor,dest_interface,message_text 
 | rename cdp_local_interface AS "Local Int.",cdp_neighbor AS "CDP Neighbor",dest_interface AS "Remote Int.",message_text AS "Message" 
 | sort dvc
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

null0
New Member

well it seems working fine adding host="$host$" to NON_PIVOT query you posted. I'll try soon to adapt all others queries and will send you a feedback.

thanks a lot

0 Karma

niketn
Legend

Sure, check and revert back. If your issue gets resolved, don't forget to accept the answer 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...