Splunk Search

How to set a splunk token in a search query

rkris
Explorer

I've created a text form input called 'username' to search for usernames in my dashboard panels and i've set the token value to 'user_name'   

   splunk_qns1.PNG

Now, I'm trying to add the above token value to this search string which filters out all the users with failed logins

splunk_qns1a.PNG

But, I'm not sure how to add the token to this search query. Does anyone know how to do this?

Labels (3)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Just add the following line after your rex statement

| where match(User_Name,"$user_name$")

OR

| where match(User_Name,"(?i)$user_name$")

The second will do a case insensitive match. Note that this is a partial match. Use any of the regex qualifiers to enhance the search as needed, such as ^ and $ to match the start and end for complete matches.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Just add the following line after your rex statement

| where match(User_Name,"$user_name$")

OR

| where match(User_Name,"(?i)$user_name$")

The second will do a case insensitive match. Note that this is a partial match. Use any of the regex qualifiers to enhance the search as needed, such as ^ and $ to match the start and end for complete matches.

 

rkris
Explorer

@bowesmana 

I used this line in my panel search below

| where match(User_Name,"$user_name$")

 

splunk_qns4_p1.PNG

 

And i used the same token in my dropdown field so that i when i select the values from the dropdown field, it will appear in the panel. 

splunk_qns4_p2.PNG

 

When i cancelled the search in the dropdown function, i was supposed to get back all the user accounts with failed logins like this:

splunk_qns4_p3.PNG

 

Instead, I got this:

splunk_qns4_p4.PNG

 

How do i get rid of this error?

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

When you get the 'waiting for input' and you are using tokens, it generally means the token has not been set, so the search that uses the token will not run. 

Not sure why you are seeing that, but I am not sure what you mean by cancelling the dropdown search...

 

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...