Splunk Search

How to edit my dashboard XML with 3 text input forms to submit a search, even if only 1 or 2 text inputs have values?

smaran06
Path Finder

Hi There,

I have 3 text boxes. All three may have values and sometimes only one or two text boxes will have values to search.

My Query up on submit it always waits until all the text boxes have values. Can you let me know how I can submit values to search, even if only one text box has a value?

Adding default values to the text box is giving me wrong results as it searches for default values too.

Splunk search used:

sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

Below is sample XML which I am using in my dashboard:

Dashboard

<input type="text" token="input1" >

</input>
<input type="text" token="input2" >
  <label>input2</label>
</input>

<input type="text" token="input3" ></input>


<input type="time" token="time">
  <label></label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <event>
    <title> ERRORS</title>
    <search>
      <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </event>
</panel>

sundareshr
Legend

If you have a default value that does not exist in your events, your current approach should work. For example

        <input type="text" token="input1" >
        <default>Enter Keyword</default>
         </input>
         <input type="text" token="input2" >
           <label>input2</label>
        <default>Enter Keyword</default>
         </input>
    <panel>
       <event>
         <title> ERRORS</title>
         <search>
           <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"</query>

Your final search will be

sourcetype="sourcetype"   ("*Enter Keyword*") OR ("*Enter Keyword*") OR ("*User Entered Text*")(application="applicationname") source="source"  ERROR host="host"

As long as one of them has a "user entered value", this should work.

0 Karma

somesoni2
Revered Legend

Try like this

Text input (similar change for all 3)

<input type="text" token="input1" >
<default>Not Provided</default>
 </input>

Panel Query

sourcetype="sourcetype"   (application="applicationname") source="source"  ERROR host="host" ([| gentimes start=-1 | query=replace("$input1$#$input2$#$input3$","Not Provided","") | makemv query delim="#" | mvexpand query| table query | eval query="*".query."*"  ]) 
0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...