How to create Splunk search based on textbox field?

[srv007]

I have a splunk search query which shows the details but the problem here is it only shows the results if the hostname passed in the text box is with fqdn. If hostname entered is without fqdn it won't show any result. How do I make the query to work if I pass abc123.xyz.com or abc123.

Apologizes if it's already answered, very new to Splunk.

[VatsalJagani · Accepted solution]

Welcome to Splunk Community @srv007 .

I think answer by @gcusello should solve your problem. (Basically using wildcard).

[VatsalJagani]

Hello @srv007, I'm a Splunk Community Moderator,

Kindly accept the answer posted by @gcusello ,  as that's the answer to your question.

On my post, you can add "Karma/Upvote" if you like it. That would be appreciated!!

Thanks @srv007 , Happy Splunking!!!

[woodcock]

Have a hidden base search that uses the input from the text box and changes the "$host_from_textbox_token$" value from it like this:

|makeresults
| eval host="$host_from_textbox_token$"
| lookup dnslookup clienthost AS host OUTPUT clientip AS ipFromHost
| lookup dnslookup clientip AS host OUTPUT clienthost AS hostFromIp
| rex field=host "(?<barehost>.*?)\.\w+\.\w+$"
| eval host = mvappend(host, ipFromHost, hostFromIp, barehost)
| table host
| format

Then use grab "$result.search$" in the "change" section to set another token and use that one everywhere else.

[srv007]

Correction -

It's text box pannel and not text book.

[gcusello]

Hi @srv007 ,

are you speaking of a text input panel to perform a search?

If yes, you can add an asterisk in prefix and suffix:

    <input type="text" token="user">
      <label>User</label>
      <choice value="*">All</choice>
      <default>*</default>
      <prefix>user="*</prefix>
      <suffix>*"</suffix>
      <fieldForLabel>user</fieldForLabel>
      <fieldForValue>user</fieldForValue>
    </input>

 Ciao.

Giuseppe