Solved: Re: Splunk Dashboard Text FIlter

CodingMaestro · ‎05-11-2023

I have a splunk dashboard that looks like below,

And i have added the text filter. But when i try to search of the text filter it works. But it only works when i search by one App. But i want it to search so that if i search,
Max, Pan, Ian
It will give me the details for the 3 rows. I have 4000 unique apps so i want it so that if i search Max, Pan, Ian it will give me 3 row details.

If someone can help me on this, it would be greatly appreciated.

ITWhisperer · ‎05-11-2023

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

View solution in original post

ITWhisperer · ‎05-11-2023

I presume you have an text input and are using the token in the search for the table.

Are you working with Classic / SimpleXML dashboard or Dashboard Studio?

CodingMaestro · ‎05-11-2023

Yes that's correct,

And its a classic dashboard

ITWhisperer · ‎05-11-2023

In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause

... app IN ($applist$)

CodingMaestro · ‎05-11-2023

This Alone worked, Thanks.

CodingMaestro · ‎05-11-2023

Could you please explain further how to set up a change handler, and how to do it. Thanks.

ITWhisperer · ‎05-11-2023

I thought by your handle you were a Maestro? 😀

Depending on how sophisticated you want to be in preprocessing the text input (here I have just removed embedded spaces), you could try something like this

<form version="1.1">
  <label>Text parsing</label>
  <fieldset submitButton="false">
    <input type="text" token="apps">
      <label>Application filter</label>
      <change>
        <eval token="app_filter">"\"".mvjoin(split(replace($apps$," ",""),","),"\",\"")."\""</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>... app IN ($app_filter$)</html>
    </panel>
  </row>
</form>

How to achieve Splunk Dashboard text filter?

field extraction

fields

lookup

search job inspector

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation