Splunk Search

HTML Dashboard - Clarification on the search

Jananee_iNautix
Path Finder

A HTML Dashboard is created that has five textboxes and one search button.When the search button is clicked,the values given in the textboxes get replaced in the search query and search will run displaying the results.Here,the search will produce the result only when ALL THE FIVE TEXTBOXES are supplied with the value.

If any of five textboxes information is provided, currently the error message dispalyed is "Search query fully not resolved" in the result panel.
Is it possible to run the search successfully providing few of the five textboxes info.

For example,
There are three textboxes named Filename, Server ,Service and one Search button.The search involved to display the results is as
"main search query"|search Filename=$Filename Server=$server$ Service=$service$.

When all the three values are supplied, the given values get replaced in the search query and the results are displayed with no issues.

But only if two of th three (or) one of the three textboxes are supplied with value and others being left blank,the search query is not working.Is there any way to make the search query work with minimal fields supplied with values?

Tags (1)
0 Karma

aholzer
Motivator

You need to define a default value for the search to have when nothing is set.

Here's the code to do it with in simple xml:

    <input type="text" token="Filename">
      <label>Enter a Filename:</label>
      <default>*</default>
    </input>

This is how you do it inside an HTML:

 <div class="fieldset">
    <div class="input input-text" id="field1">
        <label>Enter an integer N:</label>
    </div>
    <div class="input form-submit" id="search_btn">
        <button class="btn btn-primary submit">Search</button>
    </div>
</div>

And you set the default value with javascript:

var field1 = new TextInput({
            "id": "field1",
            "default": "1",
            "value": "$form.limit$",
            "el": $('#field1')
        }, {tokens: true}).render();

Hope this helps.

Note that you can find a lot of examples like the above from the example dashboards app that Splunk has available for downloads.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...