Splunk Search

How to accept multiple value inputs in a Splunk Form?

marquiselee
Path Finder

alt text

So I'm setting up a form/dashboard so that team members can lookup file information. Right now the form can only accept 1 value and thus only return results on the one file. However I'd like like to enable people to enter a comma separated list of values.

e.g. user enters the following fileids into the splunk form, and returns info on all files.
1004043,38945894,8954829,438989233

thoughts?

Tags (3)

jonuwz
Influencer

In advanced XML I've done this in the past :

<module name="ExtendedFieldSearch">
    <param name="field">Comma seperated list</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="multi_search">
            <param name="fillOnEmpty">false</param>
            <param name="prefix">
                <![CDATA[[search * | head 1 | eval CL4="]]>
            </param>
            <param name="suffix">
                <![CDATA[" | makemv delim="," CL4 | mvexpand CL4 | fields CL4] ]]>
            </param>
        </param>
    </param>
</param>

So what you're essentially doing is :

[search * | head 1 | eval CL4="your,comma,seperated,list"| makemv delim="," CL4 | mvexpand CL4 | fields CL4]

which will insert :
((CL4=your) OR (CL4=comma) OR (CL4=seperated) OR (CL4=list))

anywhere you specify $multi_search$ in your main search

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...