How to create dashboard which takes multiple(bulk) inputs ?

[splunkerer]

Hello,

I am creating a dashboard, no matter which input can be used, but need is to paste multiple input into dashboard input and search them in a certain index.

for example:
I want to search comma delimited IP addresses such as 

1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4  --->input format is not a case, I can provide different formatted multiple data. 

I want to paste these into input ( no matter which kind) and these will be formatted and created a search in the panel like below.

index=traffic src=1.1.1.1 OR src=2.2.2.2 OR src=3.3.3.3 OR src=4.4.4.4
| table _time src dst port

Please recommend how I can do it.

Thanks,  

[kamlesh_vaghela · Accepted solution]

@splunkerer 

Can you please try this?

index=traffic [| makeresults | eval src="$tkn_src$" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port

My Sample Search :

index=traffic [| makeresults | eval src="1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

[splunkerer]

Thanks a lot, this is working. In the first try, I provided input with space after the comma, so that is why it was not working. 

[splunkerer]

Thanks for quick answer, It takes first IP, but not second IP unfortunately. Any idea about the issue? 

index=traffic
[| makeresults | eval src="$field1$" | eval src=split(src,",")
| mvexpand src | table src]

| table _time src dst port

[kamlesh_vaghela]

@splunkerer 

It is working for me. Please refer my sample XML.

<form>
  <label>mutiliput</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" [| makeresults | eval date_second="$field1$" | eval date_second=split(date_second,",") | mvexpand date_second | table date_second] | stats count by date_second</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

Still you to found issue then please share your sample XML as well.

Thanks

KV

[splunkerer]

same unfortunately, the first value is taken but not rest of them.

<form>
<label>mutiliput</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index="traffic" [| makeresults | eval src="$field1$" | eval src=split(src,",") | mvexpand src | table src] | table src, dst</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>

[kamlesh_vaghela]

@splunkerer 

Can you please try this?

index="traffic" src=* [| makeresults | eval src="$field1$" | eval src=split(src,",") | mvexpand src | table src] | table src, ds

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.