Splunk Search

How to accept multiple value inputs in a Splunk Form?

marquiselee
Path Finder

alt text

So I'm setting up a form/dashboard so that team members can lookup file information. Right now the form can only accept 1 value and thus only return results on the one file. However I'd like like to enable people to enter a comma separated list of values.

e.g. user enters the following fileids into the splunk form, and returns info on all files.
1004043,38945894,8954829,438989233

thoughts?

Tags (3)

jonuwz
Influencer

In advanced XML I've done this in the past :

<module name="ExtendedFieldSearch">
    <param name="field">Comma seperated list</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="multi_search">
            <param name="fillOnEmpty">false</param>
            <param name="prefix">
                <![CDATA[[search * | head 1 | eval CL4="]]>
            </param>
            <param name="suffix">
                <![CDATA[" | makemv delim="," CL4 | mvexpand CL4 | fields CL4] ]]>
            </param>
        </param>
    </param>
</param>

So what you're essentially doing is :

[search * | head 1 | eval CL4="your,comma,seperated,list"| makemv delim="," CL4 | mvexpand CL4 | fields CL4]

which will insert :
((CL4=your) OR (CL4=comma) OR (CL4=seperated) OR (CL4=list))

anywhere you specify $multi_search$ in your main search

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...