Solved: How to achieve Splunk Dashboard text filter?

CodingMaestro · ‎05-11-2023

I have a splunk dashboard that looks like below,

And i have added the text filter. But when i try to search of the text filter it works. But it only works when i search by one App. But i want it to search so that if i search,
Max, Pan, Ian
It will give me the details for the 3 rows. I have 4000 unique apps so i want it so that if i search Max, Pan, Ian it will give me 3 row details.

If someone can help me on this, it would be greatly appreciated.

ITWhisperer · ‎05-11-2023

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

View solution in original post

ITWhisperer · ‎05-11-2023

I presume you have an text input and are using the token in the search for the table.

Are you working with Classic / SimpleXML dashboard or Dashboard Studio?

CodingMaestro · ‎05-11-2023

Yes that's correct,

And its a classic dashboard

ITWhisperer · ‎05-11-2023

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

CodingMaestro · ‎05-11-2023

This Alone worked, Thanks.

CodingMaestro · ‎05-11-2023

Could you please explain further how to set up a change handler, and how to do it. Thanks.

ITWhisperer · ‎05-11-2023

I thought by your handle you were a Maestro? 😀

Depending on how sophisticated you want to be in preprocessing the text input (here I have just removed embedded spaces), you could try something like this

<form version="1.1">
  <label>Text parsing</label>
  <fieldset submitButton="false">
    <input type="text" token="apps">
      <label>Application filter</label>
      <change>
        <eval token="app_filter">"\"".mvjoin(split(replace($apps$," ",""),","),"\",\"")."\""</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>... app IN ($app_filter$)</html>
    </panel>
  </row>
</form>

How to achieve Splunk Dashboard text filter?

field extraction

fields

lookup

other

search job inspector

Troubleshooting the OpenTelemetry Collector

Adoption of Infrastructure Monitoring at Splunk

Modern way of developing distributed application using OTel