Bluecoat proxy query

[shandman]

Hello.

I'm trying to create a query that will show total traffic to a url. Showing total traffic by top users per day. So,

index=bluecoat url=urlhere user=userhere bytes_in=?? bytes_out=??

all field names are valid.. just trying to get the values to show how I want. being able to create a dashboard with a box where I could enter a user name and display those values would also be great.

Thank you in advance.

[rajindurbal]

Good afternoon @shandman ,

The easiest way to do this is with tokens on your dashboard. I suggest using the text input from the input dropdown at the top of the dashboard editor.

This link may assist you with creating tokens:
https://docs.splunk.com/Documentation/Splunk/7.2.6/Viz/tokens

Rajin