Splunk Search

How can I use a dashboard form to search an index for multiple single field values space delimited simultaneously, such as usernames and then in my output match them against another field such as phonenumber, address etc?

cdurk
Engager

Basically looking to create a table with matching items ie if I search for the following field username in active directory:
bob.smith tom.smith etc.

I want to match the results corresponding phone number, email etc. via a table

0 Karma
1 Solution

maciep
Champion

so you want a text input on your dashboard where someone could just type in a list of usernames separated by spaces? And then you want to table the results of each including some info about them?

Not sure what your data looks like, but assuming you have fields called user, phone and email in your events and your input token is called t_users, then something like this might work.

index=some_index sourcetype=some:user:info
[
  | stats count 
  | eval user = split("$t_users$"," ") 
  | fields - count
  | mvexpand user
]
| table user, phone, email

The subsearch will just create a set of events for each user in the text box. Each of those events will just have one field called user. So once Splunk resolves the subsearch, the main search will look more like this (which you can see in the search log):

index=some_index sourcetype=some:user:info (user="bob.smith" OR user=" tom.smith")
| table user, phone, email

Hopefully that's sort of what you're after or helps a bit at least.

View solution in original post

cdurk
Engager

@maciep thank you so much, this was exactly what I needed. Your a legend!

0 Karma

adonio
Ultra Champion

@cdurk,
how your data looks like? is it Active Directory data?
if so, here is a link that explains how to create an identities list using AD
http://docs.splunk.com/Documentation/ES/4.7.2/Admin/Examplemethodsofaddingassetandidentitydata
hope it helps

0 Karma

maciep
Champion

so you want a text input on your dashboard where someone could just type in a list of usernames separated by spaces? And then you want to table the results of each including some info about them?

Not sure what your data looks like, but assuming you have fields called user, phone and email in your events and your input token is called t_users, then something like this might work.

index=some_index sourcetype=some:user:info
[
  | stats count 
  | eval user = split("$t_users$"," ") 
  | fields - count
  | mvexpand user
]
| table user, phone, email

The subsearch will just create a set of events for each user in the text box. Each of those events will just have one field called user. So once Splunk resolves the subsearch, the main search will look more like this (which you can see in the search log):

index=some_index sourcetype=some:user:info (user="bob.smith" OR user=" tom.smith")
| table user, phone, email

Hopefully that's sort of what you're after or helps a bit at least.

woodcock
Esteemed Legend

You need a |noop at the beginning of your subsearch and you shouldn't need the mvexpand part.

0 Karma

maciep
Champion

why do I need a noop? It seems to work as is for me (6.6.x on laptop)...haven't used noop for a bit, but maybe I should start again? Does the subsearch resolve multi value fields like separate events ?

0 Karma

woodcock
Esteemed Legend

Interesting; when did stats become a generating command? You are correct; though; |noop is no longer necessary. Yes, the subsearch automatically resolves multi-valued fields in the way that you would expect.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...