Getting Data In

filter a table in a dashboard from textbox

behudelson
Path Finder

Hello,

This seems like it should be straightforward but I am struggling to find a solution. I would like to filter the results shown on a table based on the value of a textbox, however the initial load of the table should not be filtered.

For example:

<search> | table ID Make Model Year

When a value is entered into a textbox field then I would like to filter the results of the table by Model only. Perhaps another textbox to filter the results on Make.

Thank you for any insights!

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

I have tried same in XML. Can you please try it?

<form>
  <init>
    <set token="form.tkn_make"></set>
    <set token="form.tkn_model"></set>
  </init>
  <label>filter a table in a dashboard from textbox</label>
  <fieldset submitButton="false">
    <input type="text" token="tkn_make" searchWhenChanged="true">
      <label>Make</label>
    </input>
    <input type="text" token="tkn_model" searchWhenChanged="true">
      <label>Model</label>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults | eval ID="1", Make="MK",Model="Mo",Year="100" | where (like(lower(Make),lower("%$tkn_make$%")) OR like(lower(Model),lower("%$tkn_model$%")) ) </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

niketn
Legend

@kamlesh_vaghela, instead of using <init> section, I would use submit button so that search runs when user confirms after providing both model and make.

<fieldset submitButton="false">

I would also add depends to row, so that row is displayed only when both tokens are present.

<row depends="$tkn_make$,$tkn_model$">

Finally, the search query should filter results as early as possible which would be in the base search i.e.

<query>
        <YourBaseSearch> Make="$tkn_make$" Model="$tkn_model$" | <YourRemainingSearch>
</query>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

behudelson
Path Finder

This makes complete sense and worked for me. Thanks @kamlesh_vaghela.

0 Karma

Richfez
SplunkTrust
SplunkTrust

You'll want to review the Form Examples section of the Dashboards and Visualizations manual. I think most of that ought to be reasonably easy if you follow the docs.

If you get part way throughthat and have problems or questions, ask away!

0 Karma
Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...