Splunk Search

How to accept multiple value inputs in a Splunk Form?

marquiselee
Path Finder

alt text

So I'm setting up a form/dashboard so that team members can lookup file information. Right now the form can only accept 1 value and thus only return results on the one file. However I'd like like to enable people to enter a comma separated list of values.

e.g. user enters the following fileids into the splunk form, and returns info on all files.
1004043,38945894,8954829,438989233

thoughts?

Tags (3)

jonuwz
Influencer

In advanced XML I've done this in the past :

<module name="ExtendedFieldSearch">
    <param name="field">Comma seperated list</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="multi_search">
            <param name="fillOnEmpty">false</param>
            <param name="prefix">
                <![CDATA[[search * | head 1 | eval CL4="]]>
            </param>
            <param name="suffix">
                <![CDATA[" | makemv delim="," CL4 | mvexpand CL4 | fields CL4] ]]>
            </param>
        </param>
    </param>
</param>

So what you're essentially doing is :

[search * | head 1 | eval CL4="your,comma,seperated,list"| makemv delim="," CL4 | mvexpand CL4 | fields CL4]

which will insert :
((CL4=your) OR (CL4=comma) OR (CL4=seperated) OR (CL4=list))

anywhere you specify $multi_search$ in your main search

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...