Splunk Search

Is it possible to Search within a table on a dashboard?

JunkyardDog
New Member

I have created a dashboard panel which displays events from a firewall log.  Importantly, this panel is intended to show a request within the context of other requests around it.  Filtering isn't desirable, as that removes the request from the context.

the dashboard uses the search: 

 

 

 

[ search index=firewall
src_ip=$src$
dest_ip=$dest$ |
eval earliest = min(_time)-60 |
eval latest = max(_time)+60
| table  earliest, latest ]
index=firewall dest_zone=external src_ip=$src$
| sort _time asc
 | table  _time src_ip dest_ip InitiatorPackets InitiatorBytes ResponderPackets ResponderBytes URL SSLServerName URLReputation  URLCategory sourcetype

 

 

 

This search can result in many rows and the panel paginates them as expected.  However, because the panel is displaying results from both before and after the event in question, that event is likely to end up somewhere in the middle of the results and on a page after the first.  Is it possible to search within these results and have the panel automatically jump to the page where the expected result is displayed?  E.g. if the request with the matching $src$ and $dest ip addresses is on page 3, then after the panel loads the data, it auto-navigates to page 3? 

As a secondary question, is it possible to add a search box to the panel which would allow searching within the table and jumping the panel to the page with the expected result?  E.g. I have some sort of text box above just that panel.  If I type 'foobar.com' in the textbox, the panel jumps to the first page where 'foobar.com' is seen in the SSLServerName column?

Labels (1)
Tags (2)
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You can using post processing. 🙂
Depending on the the number of results, since there is limitation of 500.000 results, you can use your current search as a base search of you dashboard and then  your post processing search could be `| search $your_filter$`. By doing this you can search the table results without rerunning the entire search.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...