How to edit my dashboard XML with 3 text input forms to submit a search, even if only 1 or 2 text inputs have values?

[smaran06]

Hi There,

I have 3 text boxes. All three may have values and sometimes only one or two text boxes will have values to search.

My Query up on submit it always waits until all the text boxes have values. Can you let me know how I can submit values to search, even if only one text box has a value?

Adding default values to the text box is giving me wrong results as it searches for default values too.

Splunk search used:

sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

Below is sample XML which I am using in my dashboard:

Dashboard

<input type="text" token="input1" >

</input>
<input type="text" token="input2" >
  <label>input2</label>
</input>

<input type="text" token="input3" ></input>


<input type="time" token="time">
  <label></label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <event>
    <title> ERRORS</title>
    <search>
      <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </event>
</panel>

[sundareshr]

If you have a default value that does not exist in your events, your current approach should work. For example

        <input type="text" token="input1" >
        <default>Enter Keyword</default>
         </input>
         <input type="text" token="input2" >
           <label>input2</label>
        <default>Enter Keyword</default>
         </input>
    <panel>
       <event>
         <title> ERRORS</title>
         <search>
           <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"</query>

Your final search will be

sourcetype="sourcetype"   ("*Enter Keyword*") OR ("*Enter Keyword*") OR ("*User Entered Text*")(application="applicationname") source="source"  ERROR host="host"

As long as one of them has a "user entered value", this should work.

[somesoni2]

Try like this

Text input (similar change for all 3)

<input type="text" token="input1" >
<default>Not Provided</default>
 </input>

Panel Query

sourcetype="sourcetype"   (application="applicationname") source="source"  ERROR host="host" ([| gentimes start=-1 | query=replace("$input1$#$input2$#$input3$","Not Provided","") | makemv query delim="#" | mvexpand query| table query | eval query="*".query."*"  ])