Splunk Search

How to get two form inputs to run separate searches, each with their own submit button in a Simple XML dashboard?

chadman
Path Finder

I'm trying to get 2 separate searches to work on a simple xml dashboard. I would like to have 2 input boxes and 2 search buttons. I tried this and get 2 input boxes, but only have one search button.

<form>
  <label>Workstation NEW Search</label>

  <fieldset>


       <input type="text" token="desktop">
       <label>Serial Number</label>
       <suffix>*</suffix>
                 </input>
  <input type="time">
      <default>Last 24 hours</default>
  </input>

<input type="text" token="userid">
       <label>User Name</label>
       <suffix>*</suffix>
   </input>
  <input type="time">
      <default>Last 24 hours</default>
  </input>
</fieldset>

How can I get 2 search buttons? So if I click one, it should only run search in my first row. If I enter text in the second textbox, it should run a search in the second row.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

I think you can do this in two ways. First - ignore the submit buttons, and change the inputs to "Search when Changed". You can do this in the "Edit Panels" and edit the inputs (Splunk 6.2).

OR

You might be able to specify two fieldsets - note: I haven't tried it.

 <fieldset>
 <input type="text" token="desktop">
    <label>Serial Number</label>
    <suffix>*</suffix>
              </input>
<input type="time">
   <default>Last 24 hours</default>
</input>

</fieldset><fieldset>

<input type="text" token="userid">
    <label>User Name</label>
    <suffix>*</suffix>
    </input>
   <input type="time">
   <default>Last 24 hours</default>
   </input>
   </fieldset>
0 Karma

chadman
Path Finder

2 field sets does not work. I'm using version 5 and don't see that option and not sure how to do your first option. Maybe that does not work in my version.

I did find a post with this

Example

This looks close, but it has the 2 searches in the first row. I was hoping to do something similar, but have row one do the first search and the last rows do the second. Any ideas how to make that work?

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...