Solved: How to achieve Splunk Dashboard text filter?

CodingMaestro · ‎05-11-2023

I have a splunk dashboard that looks like below,

And i have added the text filter. But when i try to search of the text filter it works. But it only works when i search by one App. But i want it to search so that if i search,
Max, Pan, Ian
It will give me the details for the 3 rows. I have 4000 unique apps so i want it so that if i search Max, Pan, Ian it will give me 3 row details.

If someone can help me on this, it would be greatly appreciated.

ITWhisperer · ‎05-11-2023

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

View solution in original post

ITWhisperer · ‎05-11-2023

I presume you have an text input and are using the token in the search for the table.

Are you working with Classic / SimpleXML dashboard or Dashboard Studio?

CodingMaestro · ‎05-11-2023

Yes that's correct,

And its a classic dashboard

ITWhisperer · ‎05-11-2023

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

CodingMaestro · ‎05-11-2023

This Alone worked, Thanks.

CodingMaestro · ‎05-11-2023

Could you please explain further how to set up a change handler, and how to do it. Thanks.

ITWhisperer · ‎05-11-2023

I thought by your handle you were a Maestro? 😀

Depending on how sophisticated you want to be in preprocessing the text input (here I have just removed embedded spaces), you could try something like this

<form version="1.1">
  <label>Text parsing</label>
  <fieldset submitButton="false">
    <input type="text" token="apps">
      <label>Application filter</label>
      <change>
        <eval token="app_filter">"\"".mvjoin(split(replace($apps$," ",""),","),"\",\"")."\""</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>... app IN ($app_filter$)</html>
    </panel>
  </row>
</form>

How to achieve Splunk Dashboard text filter?

field extraction

fields

lookup

other

search job inspector

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

.conf24 | Personalize your .conf experience with Learning Paths!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...