Splunk Search

How to create Splunk search based on textbox field?

srv007
Path Finder

I have a splunk search query which shows the details but the problem here is it only shows the results if the hostname passed in the text box is with fqdn. If hostname entered is without fqdn it won't show any result. How do I make the query to work if I pass abc123.xyz.com or abc123.

Apologizes if it's already answered, very new to Splunk.

Labels (1)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

Welcome to Splunk Community @srv007 .

I think answer by @gcusello should solve your problem. (Basically using wildcard).

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

Welcome to Splunk Community @srv007 .

I think answer by @gcusello should solve your problem. (Basically using wildcard).

VatsalJagani
SplunkTrust
SplunkTrust

Hello @srv007, I'm a Splunk Community Moderator,

Kindly accept the answer posted by @gcusello ,  as that's the answer to your question.

On my post, you can add "Karma/Upvote" if you like it. That would be appreciated!!

 

Thanks @srv007 , Happy Splunking!!!

woodcock
Esteemed Legend

Have a hidden base search that uses the input from the text box and changes the "$host_from_textbox_token$" value from it like this:

|makeresults
| eval host="$host_from_textbox_token$"
| lookup dnslookup clienthost AS host OUTPUT clientip AS ipFromHost
| lookup dnslookup clientip AS host OUTPUT clienthost AS hostFromIp
| rex field=host "(?<barehost>.*?)\.\w+\.\w+$"
| eval host = mvappend(host, ipFromHost, hostFromIp, barehost)
| table host
| format


Then use grab "$result.search$" in the "change" section to set another token and use that one everywhere else.

srv007
Path Finder

Correction -

It's text box pannel and not text book.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @srv007 ,

are you speaking of a text input panel to perform a search?

If yes, you can add an asterisk in prefix and suffix:

    <input type="text" token="user">
      <label>User</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>user="*</prefix>
      <suffix>*"</suffix>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
    </input>

 Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...