Different searches based on a radio button selecti...

alex_kh · ‎11-05-2018

Hello Everybody
I have 4 input fields: Username,IP, System,mac
The goal: user enters one value(Username,IP, System,mac) and the rest stays *
The Search is performed over 9 different indexes
Result: i get all the results where the selected field matches the input

Example 1:
Input
Username=Alex
IP=*
System=*
mac=*
Result
alex 1.1.1.1 linux aa:aa:aa
alex NULL windows bb:bb:bb
alex NULL NULL cc:cc:cc
etc.

Example 2

Input
Username=*
IP=1.1.1.1
System=*
mac=*
Result
alex 1.1.1.1 linux aa:aa:aa
Null 1.1.1.1 windows bb:bb:bb
Bob 1.1.1.1. NULL cc:cc:cc
etc.

If i write the search with OR (user=Alex or ip=*...) i get also the results for bob sally and user=NULL.

As you can see the problem is i can not predict which input will the user do.
My idea: insert a radio button with 4 values (Username,IP, System,mac)
Depending on the input of the radio button 4 different searches will be executed.

Is it somehow possible? Are there any other ideas how to create my dashboard?

renjith_nair · ‎11-05-2018

@alex_kh, does it make sense to leave the 4 options to user and let him decide what he wants to enter and we take the corresponding value as token to the searches? In that case, we could keep * as default and let the user change whichever the input he wants. Or do you want to restrict the user options to only one at a time?

<form>
  <fieldset submitButton="false">
    <input type="text" token="username" searchWhenChanged="true">
      <label>Username</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="ip" searchWhenChanged="true">
      <label>IP</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="system" searchWhenChanged="true">
      <label>System</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="mac" searchWhenChanged="true">
      <label>MAC</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <html>
      <h1> executing the search with Username=$username$ IP=$ip$ System=$system$ MAC=$mac$</h1>
    </html>
  </row>
</form>

---
What goes around comes around. If it helps, hit it with Karma 🙂

Different searches based on a radio button selection

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation