Splunk Search

How to use a drop-down form for a search?

chandra61446
New Member

I have below search which has a CSV input (example host and category)

 host        server1     server2    server3    server4    server5
 Catagory         AP          NA         NA         EU         AP

Now I have below search which gives output

|inputlookup Messaging_Servers.csv | join type=outer max=0 host [ search sourcetype=domino-stats "Platform.Memory.RAM.TotalMBytes" ]
| join type=outer max=0 host [ search sourcetype=domino-stats "Http.Workers" ]
|table host Platform_Memory_RAM_TotalMBytes Http_Workers |dedup host  

Now I would like to have a drop-down form, and if I select AP then only server 1 and server 5 output should be shown in the dashboard with Platform_Memory_RAM_TotalMBytes and Http_Workers values.

0 Karma

thiago2d
New Member

In the Dashboard screen select Edit -> Edit Panels in the dropdown item select Edit Input and edit the token field in your search, replace the value you want for $ token $.

Dropdown Title </ label>

Default Item </ default>
Item 1 </ choice>
Item 2 </ choice>
</ Input>
</ Label>

0 Karma

kbrown_splunk
Splunk Employee
Splunk Employee

The answer is to use a token in your panel search that points to your dropdown. This is very easy to do. Please see http://docs.splunk.com/Documentation/Splunk/6.4.1/Viz/tokens

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...