Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Different searches based on a radio button selecti...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Different searches based on a radio button selection
Hello Everybody
I have 4 input fields: Username,IP, System,mac
The goal: user enters one value(Username,IP, System,mac) and the rest stays *
The Search is performed over 9 different indexes
Result: i get all the results where the selected field matches the input
Example 1:
Input
Username=Alex
IP=*
System=*
mac=*
Result
alex 1.1.1.1 linux aa:aa:aa
alex NULL windows bb:bb:bb
alex NULL NULL cc:cc:cc
etc.
Example 2
Input
Username=*
IP=1.1.1.1
System=*
mac=*
Result
alex 1.1.1.1 linux aa:aa:aa
Null 1.1.1.1 windows bb:bb:bb
Bob 1.1.1.1. NULL cc:cc:cc
etc.
If i write the search with OR (user=Alex or ip=*...) i get also the results for bob sally and user=NULL.
As you can see the problem is i can not predict which input will the user do.
My idea: insert a radio button with 4 values (Username,IP, System,mac)
Depending on the input of the radio button 4 different searches will be executed.
Is it somehow possible? Are there any other ideas how to create my dashboard?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@alex_kh, does it make sense to leave the 4 options to user and let him decide what he wants to enter and we take the corresponding value as token to the searches? In that case, we could keep * as default and let the user change whichever the input he wants. Or do you want to restrict the user options to only one at a time?
<form>
<fieldset submitButton="false">
<input type="text" token="username" searchWhenChanged="true">
<label>Username</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="ip" searchWhenChanged="true">
<label>IP</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="system" searchWhenChanged="true">
<label>System</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="text" token="mac" searchWhenChanged="true">
<label>MAC</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<html>
<h1> executing the search with Username=$username$ IP=$ip$ System=$system$ MAC=$mac$</h1>
</html>
</row>
</form>
What goes around comes around. If it helps, hit it with Karma 🙂
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
