Splunk Search

Different searches based on a radio button selection

alex_kh
Explorer

Hello Everybody
I have 4 input fields: Username,IP, System,mac
The goal: user enters one value(Username,IP, System,mac) and the rest stays *
The Search is performed over 9 different indexes
Result: i get all the results where the selected field matches the input

Example 1:
Input
Username=Alex
IP=*
System=*
mac=*
Result
alex 1.1.1.1 linux aa:aa:aa
alex NULL windows bb:bb:bb
alex NULL NULL cc:cc:cc
etc.

Example 2

Input
Username=*
IP=1.1.1.1
System=*
mac=*
Result
alex 1.1.1.1 linux aa:aa:aa
Null 1.1.1.1 windows bb:bb:bb
Bob 1.1.1.1. NULL cc:cc:cc
etc.

If i write the search with OR (user=Alex or ip=*...) i get also the results for bob sally and user=NULL.

As you can see the problem is i can not predict which input will the user do.
My idea: insert a radio button with 4 values (Username,IP, System,mac)
Depending on the input of the radio button 4 different searches will be executed.

Is it somehow possible? Are there any other ideas how to create my dashboard?

Tags (1)
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@alex_kh, does it make sense to leave the 4 options to user and let him decide what he wants to enter and we take the corresponding value as token to the searches? In that case, we could keep * as default and let the user change whichever the input he wants. Or do you want to restrict the user options to only one at a time?

<form>
  <fieldset submitButton="false">
    <input type="text" token="username" searchWhenChanged="true">
      <label>Username</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="ip" searchWhenChanged="true">
      <label>IP</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="system" searchWhenChanged="true">
      <label>System</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
    <input type="text" token="mac" searchWhenChanged="true">
      <label>MAC</label>
      <default>*</default>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <html>
      <h1> executing the search with Username=$username$ IP=$ip$ System=$system$ MAC=$mac$</h1>
    </html>
  </row>
</form>
Happy Splunking!
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>