Textarea input to feed a search

[bgriffis]

I have firewall logs that feed into splunk and I'd like to have a textarea form input where I can paste in a handful of IP addresses (one per line) and have those feed a search like:
index=fw |where <any textareaIP == src_ip OR any textareaIP == dest_ip>

Seems like it would be a join, but I'm not sure how to get the multiple inputs into a search (not if a textarea is possible at all)

[MuS]

Hi bgriffis,

Take a look at the dashboard example app https://splunkbase.splunk.com/app/1265/ there you can find multiple Form Input Elements. Most likely it will be a multi-select input and for sure no need to join the search. You can define prefixes and suffixes for you input element, so you are able to build something like myinput=foo OR myinput=boo.

Hope that helps ...

cheers, MuS