Splunk Search

How to edit my dashboard XML with 3 text input forms to submit a search, even if only 1 or 2 text inputs have values?

smaran06
Path Finder

Hi There,

I have 3 text boxes. All three may have values and sometimes only one or two text boxes will have values to search.

My Query up on submit it always waits until all the text boxes have values. Can you let me know how I can submit values to search, even if only one text box has a value?

Adding default values to the text box is giving me wrong results as it searches for default values too.

Splunk search used:

sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

Below is sample XML which I am using in my dashboard:

Dashboard

<input type="text" token="input1" >

</input>
<input type="text" token="input2" >
  <label>input2</label>
</input>

<input type="text" token="input3" ></input>


<input type="time" token="time">
  <label></label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <event>
    <title> ERRORS</title>
    <search>
      <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </event>
</panel>

sundareshr
Legend

If you have a default value that does not exist in your events, your current approach should work. For example

        <input type="text" token="input1" >
        <default>Enter Keyword</default>
         </input>
         <input type="text" token="input2" >
           <label>input2</label>
        <default>Enter Keyword</default>
         </input>
    <panel>
       <event>
         <title> ERRORS</title>
         <search>
           <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"</query>

Your final search will be

sourcetype="sourcetype"   ("*Enter Keyword*") OR ("*Enter Keyword*") OR ("*User Entered Text*")(application="applicationname") source="source"  ERROR host="host"

As long as one of them has a "user entered value", this should work.

0 Karma

somesoni2
Revered Legend

Try like this

Text input (similar change for all 3)

<input type="text" token="input1" >
<default>Not Provided</default>
 </input>

Panel Query

sourcetype="sourcetype"   (application="applicationname") source="source"  ERROR host="host" ([| gentimes start=-1 | query=replace("$input1$#$input2$#$input3$","Not Provided","") | makemv query delim="#" | mvexpand query| table query | eval query="*".query."*"  ]) 
0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...