Splunk Search
Highlighted

How to create a search bar on a dashboard

Path Finder

Hello, thank you for reading this!

I am working on some searches for AD data, specfically looking at Failed Logins and Acccount Lockouts. I wrote a query that returns the results of all event codes for the aforementioned events, grouped by Account Lockout events. I'd like for other users to log onto this dashboard, and by simply typing in the "Account_Name" (as it appears in the log) return all the lockout/failed login values for a particular account.

I've been trying to create this search bar using the simple XML edit, however I havent been successful. any help would be greatly appreciated!

My search query looks like this:

search index=auth_ad sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:security" "EventCode=4740" OR "EventCode=644" OR (EventCode=4771 AND "Audit Failure") OR ("EventCode=672" AND Type="Failure Audit") OR "EventCode=675" | eval "User Account"=coalesce(User_Name,Account_Name) | eval Win2K8_acc = mvindex(Account_Name,1) | eval "Locked_Account"=coalesce(Win2K8_acc,Target_Account_Name) | transaction Account_Name startswith="EventCode=4740"

Again any advice would be greatly appreciated!

Tags (4)
Highlighted

Re: How to create a search bar on a dashboard

SplunkTrust
SplunkTrust

Try something like this. (provides a textbox and submit button. Textbox for users to input AccountName)

<form>
  <label>Search by Account Name</label> 
  <description /> 
<fieldset submitButton="true">
<input type="text" token="accountName" >
  <label>Account Name</label> 
  <default></default> 
  </input>
  </fieldset>
<row>
<event>
  <title> Failed Logins and Acccount Lockouts</title>
  <searchString>
  index=auth_ad sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:security" "EventCode=4740" OR "EventCode=644" OR (EventCode=4771 AND "Audit Failure") OR ("EventCode=672" AND Type="Failure Audit") OR "EventCode=675" | eval "User Account"=coalesce(User_Name,Account_Name) | search "User Accont"="$accountName$"| eval Win2K8_acc = mvindex(Account_Name,1) | eval "Locked_Account"=coalesce(Win2K8_acc,Target_Account_Name) | transaction Account_Name startswith="EventCode=4740"
  </searchString> 
  <option name="showPager">true</option>
  <option name="count">20</option>
  <option name="displayRowNumbers">false</option>
</event>
  </row>
  </form>

View solution in original post

Highlighted

Re: How to create a search bar on a dashboard

SplunkTrust
SplunkTrust

The token name can be different from actual field name in the logs as we just replace the value of the token in the search. I see your have a eval statement '| eval "User Account"=coalesce(UserName,AccountName)' but in rest of the search you use AccountName instead. If "User Account" field is not to be used then replace '| search "User Accont"="$accountName$"' with '| search AccountName="$accountName$"' and try

Highlighted

Re: How to create a search bar on a dashboard

Path Finder

this worked perfectly. thank you for your help! much appreciated!

0 Karma