Splunk Search

How to set a splunk token in a search query

rkris
Explorer

I've created a text form input called 'username' to search for usernames in my dashboard panels and i've set the token value to 'user_name'   

   splunk_qns1.PNG

Now, I'm trying to add the above token value to this search string which filters out all the users with failed logins

splunk_qns1a.PNG

But, I'm not sure how to add the token to this search query. Does anyone know how to do this?

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Just add the following line after your rex statement

| where match(User_Name,"$user_name$")

OR

| where match(User_Name,"(?i)$user_name$")

The second will do a case insensitive match. Note that this is a partial match. Use any of the regex qualifiers to enhance the search as needed, such as ^ and $ to match the start and end for complete matches.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Just add the following line after your rex statement

| where match(User_Name,"$user_name$")

OR

| where match(User_Name,"(?i)$user_name$")

The second will do a case insensitive match. Note that this is a partial match. Use any of the regex qualifiers to enhance the search as needed, such as ^ and $ to match the start and end for complete matches.

 

rkris
Explorer

@bowesmana 

I used this line in my panel search below

| where match(User_Name,"$user_name$")

 

splunk_qns4_p1.PNG

 

And i used the same token in my dropdown field so that i when i select the values from the dropdown field, it will appear in the panel. 

splunk_qns4_p2.PNG

 

When i cancelled the search in the dropdown function, i was supposed to get back all the user accounts with failed logins like this:

splunk_qns4_p3.PNG

 

Instead, I got this:

splunk_qns4_p4.PNG

 

How do i get rid of this error?

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

When you get the 'waiting for input' and you are using tokens, it generally means the token has not been set, so the search that uses the token will not run. 

Not sure why you are seeing that, but I am not sure what you mean by cancelling the dropdown search...

 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...