Splunk Search

Error when trying to add token to limit table results in a search?

3618475
Engager

I recreated the dashboard using the report search and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: purchCostReferenceToken

I want to limit the table results based on this token. This is the search:

 <form>
      <label>Thru Train Dashboard</label>
      <fieldset submitButton="false" autoRun="true">
        <input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
          <label>Enter a TMS Reference Number to Filter Table</label>
          <default>*</default>
          <initialValue>*</initialValue>
        </input>
      </fieldset>
      <row>
        <panel>
          <title>Thru Train Data</title>
          <table>
            <search>
              <query>index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments =  mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)"  | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time</query>
              <earliest>-30d@d</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
    </form>

Where do I add the token to limit the search?
I tried adding this to the end of the search before the table command:

 ...   | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) purchCostReference=$purchCostReferenceToken$ | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time

I get an error...error in convert command: the argument purchCostReference- is invalid
I would like to add filters in several of the table columns. The purchCostReference value is an extracted field in the search using xmlkv

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If the tokenized fields are automatically extracted then include the tokens in the base search. For example,

index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" purchCostReference=$purchCostReferenceToken$ | xmlkv ...

If the fields aren't automatically extracted then put the tokens after the field extraction.

... | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |search  segment=$purchCostReferenceToken$ | eval Segments = ....
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If the tokenized fields are automatically extracted then include the tokens in the base search. For example,

index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" purchCostReference=$purchCostReferenceToken$ | xmlkv ...

If the fields aren't automatically extracted then put the tokens after the field extraction.

... | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |search  segment=$purchCostReferenceToken$ | eval Segments = ....
---
If this reply helps you, Karma would be appreciated.

3618475
Engager

Thanks! That worked

0 Karma

3618475
Engager

In my case I just had to add "$purchCostReferenceToken$" to the query

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...