Splunk Search

How to edit my dashboard XML with 3 text input forms to submit a search, even if only 1 or 2 text inputs have values?

smaran06
Path Finder

Hi There,

I have 3 text boxes. All three may have values and sometimes only one or two text boxes will have values to search.

My Query up on submit it always waits until all the text boxes have values. Can you let me know how I can submit values to search, even if only one text box has a value?

Adding default values to the text box is giving me wrong results as it searches for default values too.

Splunk search used:

sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

Below is sample XML which I am using in my dashboard:

Dashboard

<input type="text" token="input1" >

</input>
<input type="text" token="input2" >
  <label>input2</label>
</input>

<input type="text" token="input3" ></input>


<input type="time" token="time">
  <label></label>
  <default>
    <earliest>-15m</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <event>
    <title> ERRORS</title>
    <search>
      <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"

      <earliest>$time.earliest$</earliest>
      <latest>$time.latest$</latest>
    </search>
    <option name="count">10</option>
    <option name="list.drilldown">full</option>
    <option name="list.wrap">1</option>
    <option name="maxLines">5</option>
    <option name="raw.drilldown">full</option>
    <option name="rowNumbers">0</option>
    <option name="table.drilldown">all</option>
    <option name="table.wrap">1</option>
    <option name="type">list</option>
    <fields>["host","source","sourcetype"]</fields>
  </event>
</panel>

sundareshr
Legend

If you have a default value that does not exist in your events, your current approach should work. For example

        <input type="text" token="input1" >
        <default>Enter Keyword</default>
         </input>
         <input type="text" token="input2" >
           <label>input2</label>
        <default>Enter Keyword</default>
         </input>
    <panel>
       <event>
         <title> ERRORS</title>
         <search>
           <query> sourcetype="sourcetype"   ("*$inputvalue1$*") OR ("*$inputvalue2$*") OR ("*$inputvalue3$*")(application="applicationname") source="source"  ERROR host="host"</query>

Your final search will be

sourcetype="sourcetype"   ("*Enter Keyword*") OR ("*Enter Keyword*") OR ("*User Entered Text*")(application="applicationname") source="source"  ERROR host="host"

As long as one of them has a "user entered value", this should work.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

Text input (similar change for all 3)

<input type="text" token="input1" >
<default>Not Provided</default>
 </input>

Panel Query

sourcetype="sourcetype"   (application="applicationname") source="source"  ERROR host="host" ([| gentimes start=-1 | query=replace("$input1$#$input2$#$input3$","Not Provided","") | makemv query delim="#" | mvexpand query| table query | eval query="*".query."*"  ]) 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...