I am new to Splunk and trying to know more about it. I have a dashboard where I am taking inputs from user in the form of 'radio' buttons.
Now, I want my information to be filtered according to the user input. My radio buttons are Summary and details.
xxxx | eval e1 = if("$INFO or DEBUG$"=="INFO", search string 1, search string 2) | sort _time
If the user's input is INFO, it should append search string 1 into my original 'xxxx' query and if not, then search string 2 should be appended in original query. But this code is just creating a field e1 which has correct search string according to my if statement. How can I do this?
Hi purva13,
You cannot do it this way, but you can do it in a different way. You can assign prefix
and suffix
to the radio buttons and use different values this way. Copy the below pasted XML into a new dashboard and it will show you how it can be done.
<form>
<label>run search based on button</label>
<fieldset submitButton="false" autoRun="true">
<input type="radio" token="field1" searchWhenChanged="true">
<label>what to search?</label>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<choice value="*">all</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunkd_access">splunkd_access</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>Search being run: index=_internal $$field1$$</title>
<event>
<search>
<query>index=_internal $field1$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</panel>
</row>
</form>
Hope this helps and gets you started ...
cheers, MuS
Hi purva13,
You cannot do it this way, but you can do it in a different way. You can assign prefix
and suffix
to the radio buttons and use different values this way. Copy the below pasted XML into a new dashboard and it will show you how it can be done.
<form>
<label>run search based on button</label>
<fieldset submitButton="false" autoRun="true">
<input type="radio" token="field1" searchWhenChanged="true">
<label>what to search?</label>
<prefix>sourcetype="</prefix>
<suffix>"</suffix>
<choice value="*">all</choice>
<choice value="splunkd">splunkd</choice>
<choice value="splunkd_access">splunkd_access</choice>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<title>Search being run: index=_internal $$field1$$</title>
<event>
<search>
<query>index=_internal $field1$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="count">10</option>
<option name="list.drilldown">full</option>
<option name="list.wrap">1</option>
<option name="maxLines">5</option>
<option name="raw.drilldown">full</option>
<option name="rowNumbers">0</option>
<option name="table.drilldown">all</option>
<option name="table.wrap">1</option>
<option name="type">list</option>
<fields>["host","source","sourcetype"]</fields>
</event>
</panel>
</row>
</form>
Hope this helps and gets you started ...
cheers, MuS
Hey, that sounds interesting. But while trying that I am getting an error
XML Syntax Error: Cannot find object mapper for panel type: title
Just to add, you can place search strings as well into the choice
option like this:
<choice value="_audit">search index=_internal</choice>
<choice value="_internal">search index=_audit</choice>
and using a query
option like this:
<query>$field1$</query>
But I don't want the query to be displayed to users. And I want it to be appended to original query.
Also, in the answer with suffix and prefix, are you talking about populating search?