Splunk Search

How do you build a panel with different source inputs?

pranay04
Explorer

I am trying to build a panel where I would like to input the source and present in a radial guaze.

The simple query looks something like this:

index=x host=y source = /logs/zzz* "keyword"| |timechart span=1m count as keyword

And in there I want to be able to change the "zzz" to different options as per input.

Any advice?

Tags (2)
0 Karma

woodcock
Esteemed Legend

Why not keep them all and use the Trellis feature?

https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @pranay04

To do this you need to edit the dashboard and "add an input". Edit thatinput to set a token called for example "source".

Then in your panel, update the search to look like this:

index=x host=y source = $source$* "keyword |timechart span=1m count as keyword

Here is some more info: https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens#Using_tokens_in_a_search

Good luck

0 Karma

pranay04
Explorer

Great ! Thanks! got it

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...