I have a splunk dashboard that looks like below,
And i have added the text filter. But when i try to search of the text filter it works. But it only works when i search by one App. But i want it to search so that if i search,
Max, Pan, Ian
It will give me the details for the 3 rows. I have 4000 unique apps so i want it so that if i search Max, Pan, Ian it will give me 3 row details.
If someone can help me on this, it would be greatly appreciated.
In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause
... app IN ($applist$)
I presume you have an text input and are using the token in the search for the table.
Are you working with Classic / SimpleXML dashboard or Dashboard Studio?
Yes that's correct,
And its a classic dashboard
In that case, you should set up a change handler for the input to parse the text field and create a token with the values in quotes e.g. "Max", "Pan", "Ian", then you can use the token to filter with the IN clause
... app IN ($applist$)
This Alone worked, Thanks.
Could you please explain further how to set up a change handler, and how to do it. Thanks.
I thought by your handle you were a Maestro? 😀
Depending on how sophisticated you want to be in preprocessing the text input (here I have just removed embedded spaces), you could try something like this
<form version="1.1">
<label>Text parsing</label>
<fieldset submitButton="false">
<input type="text" token="apps">
<label>Application filter</label>
<change>
<eval token="app_filter">"\"".mvjoin(split(replace($apps$," ",""),","),"\",\"")."\""</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<html>... app IN ($app_filter$)</html>
</panel>
</row>
</form>