Splunk Search
Highlighted

How to add a exclude box in the splunk dashboard?

Builder

Hi

Is there a way to add a text box which excludes the value from the search results of dashboard? I have a dashboard with search

base search | stats count by port src_ip | search port!=$22$ , I have to create a text box which excludes that value and shows all other values, i have a issue by assisting default value to this input. any suggestions?

Tags (2)
0 Karma
Highlighted

Re: How to add a exclude box in the splunk dashboard?

Legend

Option 1 would be to use text box prefix and suffix options to build text port!=<textBoxValue>

Following is easier option:

  <fieldset submitButton="false">
    <input type="text" token="filterPort">
      <label>Filter Text</label>
      <default>22</default>
      <prefix>port!="</prefix>
      <suffix>"</suffix>
    </input>
  </fieldset>

And then use $filterPort$ in your search. If I was in your place I will filter port prior to stats in my base search.

base search $filterPort$| stats count by port src_ip 

Option 2 would be to set token according to the data you have selected and code the text box change event to pass on the same to your search query:

  <fieldset submitButton="false">
    <input type="text" token="filterPort">
      <label>Filter Text</label>
      <default>22</default>
      <change>
          <set token="filterPort"> port!=$value$ </set>
      </change>
    </input>
  </fieldset>

Your search query remains the same:

base search $filterPort$| stats count by port src_ip 

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.