Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to dynamically search logs with terms like "er...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI,
i have logs written by Tomcat application
i have a table which displays time, environment, applicationame, and log info details. These are displayed based on drop-down values.
but if i want to search for particular search term like error, exception, out of memory, oserror and more, I need to pass these search terms dynamically. is there a query we can write for this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to use tokens in your SPL to filter based on user entry. Here's some documentation to get you started
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Define_tokens_for_form_inputs
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to use tokens in your SPL to filter based on user entry. Here's some documentation to get you started
http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Define_tokens_for_form_inputs
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you,i am going through the document.
some how i am not seeing Accept button.any idea on this. or
is there any issue from my side
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes,i see it now. and i just implemented Token in SPL and its working now.
may i know what is the issue with Accept button
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
At first, I had posted as a comment. Comments don't have accept. Then I changed to answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
will i get both error info and events i search like below
index=myindex java.lang.stringindexoutofboundsexception OR out of memory
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i think this is working,i just tested
index=myindex java.lang.stringindexoutofboundsexception OR (out of memory)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You should see the accept button now.
What the End of Support for Splunk Add-on Builder Means for You
Solve, Learn, Repeat: New Puzzle Channel Now Live
Building Reliable Asset and Identity Frameworks in Splunk ES
