I have a splunk search query which shows the details but the problem here is it only shows the results if the hostname passed in the text box is with fqdn. If hostname entered is without fqdn it won't show any result. How do I make the query to work if I pass abc123.xyz.com or abc123.
Apologizes if it's already answered, very new to Splunk.
Have a hidden base search that uses the input from the text box and changes the "$host_from_textbox_token$" value from it like this:
|makeresults
| eval host="$host_from_textbox_token$"
| lookup dnslookup clienthost AS host OUTPUT clientip AS ipFromHost
| lookup dnslookup clientip AS host OUTPUT clienthost AS hostFromIp
| rex field=host "(?<barehost>.*?)\.\w+\.\w+$"
| eval host = mvappend(host, ipFromHost, hostFromIp, barehost)
| table host
| format
Then use grab "$result.search$" in the "change" section to set another token and use that one everywhere else.
Correction -
It's text box pannel and not text book.
Hi @srv007 ,
are you speaking of a text input panel to perform a search?
If yes, you can add an asterisk in prefix and suffix:
<input type="text" token="user">
<label>User</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>user="*</prefix>
<suffix>*"</suffix>
<fieldForLabel>user</fieldForLabel>
<fieldForValue>user</fieldForValue>
</input>
Ciao.
Giuseppe