Splunk Search

How to create a dynamic dashboard that runs a search based on user input in a text field and drop-down selection?

servlette
Engager

Hi,

Is there a way to create a search on the fly based on user input?

What I have is a textfield and drop-down.

User enters something in the textfield and selects a value from the dro-pdown.

<form>
  <label>Simple XML</label>
  <description>My sample dashboard</description>
  <fieldset submitButton="true">
    <input type="text" token="searchText"></input>
    <input type="dropdown" token="searchBy">
      <label>Search By</label>
      <choice value="1">Foo</choice>
      <choice value="2">Bar</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Results</title>
        <search>
          <query>index=myIndex sourcetype=mySourceType Foo=$searchText$ | table Foo, Bar</query>
          <earliest></earliest>
          <latest></latest>
        </search>
        <option name="showPager">true</option>
      </table>
    </panel>
  </row>
</form>

Let's say I am logging the following:

Foo=abcd, Bar=100
Foo=dcba, Bar=101
Foo=abcd, Bar=102

When user enters "abcd" and selects Foo from the drop-down, then I need to run a search that will be like:

index=myIndex sourcetype=mysourceType Foo=abcd | table Foo, Bar

And it should display 2 rows of data for Foo=abcd

If user enters 100 and selects Bar, then the search has to be:

index=myIndex sourcetype=mysourceType Bar=100 | table Foo, Bar

How do I do this?

0 Karma
1 Solution

somesoni2
Revered Legend

Just update your panel search with this

index=myIndex sourcetype=mySourceType $searchBy$=$searchText$ | table Foo Bar

View solution in original post

Masa
Splunk Employee
Splunk Employee

How about using

( Foo=$searchText$ OR Bar=$searchText$ )

Or, maybe you can do input selection for two drop-downs ; one for Foo and the other for Bar. Then, you can use the similar query ;

( Foo=$vaalue_foo$ OR Bar=$value_bar$ )

0 Karma

somesoni2
Revered Legend

Just update your panel search with this

index=myIndex sourcetype=mySourceType $searchBy$=$searchText$ | table Foo Bar
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...