Getting Data In

filter a table in a dashboard from textbox

behudelson
Path Finder

Hello,

This seems like it should be straightforward but I am struggling to find a solution. I would like to filter the results shown on a table based on the value of a textbox, however the initial load of the table should not be filtered.

For example:

<search> | table ID Make Model Year

When a value is entered into a textbox field then I would like to filter the results of the table by Model only. Perhaps another textbox to filter the results on Make.

Thank you for any insights!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

niketn
Legend

@kamlesh_vaghela, instead of using <init> section, I would use submit button so that search runs when user confirms after providing both model and make.

<fieldset submitButton="false">

I would also add depends to row, so that row is displayed only when both tokens are present.

<row depends="$tkn_make$,$tkn_model$">

Finally, the search query should filter results as early as possible which would be in the base search i.e.

<query>
        <YourBaseSearch> Make="$tkn_make$" Model="$tkn_model$" | <YourRemainingSearch>
</query>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

behudelson
Path Finder

This makes complete sense and worked for me. Thanks @kamlesh_vaghela.

0 Karma

Richfez
SplunkTrust
SplunkTrust

You'll want to review the Form Examples section of the Dashboards and Visualizations manual. I think most of that ought to be reasonably easy if you follow the docs.

If you get part way throughthat and have problems or questions, ask away!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...