Getting Data In

filter a table in a dashboard from textbox

behudelson
Path Finder

Hello,

This seems like it should be straightforward but I am struggling to find a solution. I would like to filter the results shown on a table based on the value of a textbox, however the initial load of the table should not be filtered.

For example:

<search> | table ID Make Model Year

When a value is entered into a textbox field then I would like to filter the results of the table by Model only. Perhaps another textbox to filter the results on Make.

Thank you for any insights!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

niketn
Legend

@kamlesh_vaghela, instead of using <init> section, I would use submit button so that search runs when user confirms after providing both model and make.

<fieldset submitButton="false">

I would also add depends to row, so that row is displayed only when both tokens are present.

<row depends="$tkn_make$,$tkn_model$">

Finally, the search query should filter results as early as possible which would be in the base search i.e.

<query>
        <YourBaseSearch> Make="$tkn_make$" Model="$tkn_model$" | <YourRemainingSearch>
</query>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

behudelson
Path Finder

This makes complete sense and worked for me. Thanks @kamlesh_vaghela.

0 Karma

Richfez
SplunkTrust
SplunkTrust

You'll want to review the Form Examples section of the Dashboards and Visualizations manual. I think most of that ought to be reasonably easy if you follow the docs.

If you get part way throughthat and have problems or questions, ask away!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...