Splunk Search

Search Keywords with search button

ASR1022
Loves-to-Learn Lots

I am currently working on a search dashboard.  I have the dashboard created and the search (Submit Button).  In this search I am looking at the messaging portion of our firewall logs.  When I submit a search I have to put in the whole message example "Interface G1 Link is up".  

What I am trying to do is search for keywords like Interface, G1, link is up, link is down.  

Any info would be great.

Labels (1)
0 Karma

somesoni2
Revered Legend

Give this a try

<label>Message/Note Search</label>
<fieldset autoRun="false" submitButton="true">
<input type="time" token="field1">
<label>Time</label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="false">
<label>Sourcetype</label>
<choice value="*">All</choice>
<default>*</default>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
<![CDATA[|metadata type=sourcetypes index=netfw | stats count by sourcetype]]>
</populatingSearch>
</input>
<input type="text" token="keywords">
<label>Message/Note</label>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Source IP Search Results</title>
<search>
<query>index=scfw sourcetype="$sourcetype$" (msg="*$keywords$*" OR note="*$keywords$*")</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>

With this, you would be able to specify a single keyword OR portion of the string you're searching. (e.g. set the 'Message/Notes' textbox value to just 'G1' OR just 'Interface'. 

0 Karma

ASR1022
Loves-to-Learn Lots

That worked for me somesoni2.

 

Thanks for your help!

0 Karma

somesoni2
Revered Legend

When you open the search from your dashboard (after clicking on the little magnifying glass icon when you mouse hover the table/visualization), when search you get and what it should be? Are you using a text box to search for keywords? Should those keywords be used with 'OR' conjunction or 'AND'?

0 Karma

ASR1022
Loves-to-Learn Lots

This is the search syntax:

<label>Message/Note Search</label>
<fieldset autoRun="false" submitButton="true">
<input type="time" token="field1">
<label>Time</label>
<default>
<earliest>-4h@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="sourcetype" searchWhenChanged="false">
<label>Sourcetype</label>
<choice value="*">All</choice>
<default>*</default>
<populatingSearch fieldForValue="sourcetype" fieldForLabel="sourcetype">
<![CDATA[|metadata type=sourcetypes index=netfw | stats count by sourcetype]]>
</populatingSearch>
</input>
<input type="text" token="*">
<label>Message/Note</label>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Source IP Search Results</title>
<search>
<query>index=scfw sourcetype="$sourcetype$" (msg="$*$" OR note="$*$")</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...