Splunk Search

How to pass multiple searches from a form?



I have a search that crosses multiple indexes and sourcetypes, and the customer wants the ability to choose these searches (all or multiple) and have them run. I have macros set up for the searches, and it looks like Multi-select is the option to use in the form, but I can't figure out how to pass these as parameters in the search. Can someone help me out?

0 Karma


If your searches append to each other as plain text you could store those searches in the value of your input, and use the input's token as the sole search.

That's usually not the case though, most combination searches are more complicated than that. In such a case you can use placeholder values in your input, and set the actual search token using a conditional set element in simple XML: http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/PanelreferenceforSimplifiedXML#Eval.2C_Link.2C...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...