Splunk Search

How do you build a panel with different source inputs?

pranay04
Explorer

I am trying to build a panel where I would like to input the source and present in a radial guaze.

The simple query looks something like this:

index=x host=y source = /logs/zzz* "keyword"| |timechart span=1m count as keyword

And in there I want to be able to change the "zzz" to different options as per input.

Any advice?

Tags (2)
0 Karma

woodcock
Esteemed Legend

Why not keep them all and use the Trellis feature?

https://docs.splunk.com/Documentation/Splunk/latest/Viz/VisualizationTrellis

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Hi @pranay04

To do this you need to edit the dashboard and "add an input". Edit thatinput to set a token called for example "source".

Then in your panel, update the search to look like this:

index=x host=y source = $source$* "keyword |timechart span=1m count as keyword

Here is some more info: https://docs.splunk.com/Documentation/Splunk/7.2.3/Viz/tokens#Using_tokens_in_a_search

Good luck

0 Karma

pranay04
Explorer

Great ! Thanks! got it

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...