Splunk Search

Timechart Search using TextBox

sathish2k8
Explorer

I want to include search box to search account and it should display the timechart also. Please help. Presently only timechart is displaying.

index=os sourcetype="logger" | eval account=ltrim(field10,"[") | eval account=rtrim(account,"]")  | timechart count by account | search account=0101010101
Tags (1)
0 Karma
1 Solution

mayurr98
Super Champion

Hey @sathish2k8

Go to dashboards>>create new dashboard and put following XML

<form>
  <label>test</label>
  <fieldset submitButton="true">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>TimePicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="account" searchWhenChanged="true">
      <label>Account</label>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=os sourcetype="logger" | eval account=ltrim(field10,"[") | eval account=rtrim(account,"]")  |search account="$account$"  |  timechart count by account</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

Hey @sathish2k8

Go to dashboards>>create new dashboard and put following XML

<form>
  <label>test</label>
  <fieldset submitButton="true">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>TimePicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="account" searchWhenChanged="true">
      <label>Account</label>
      <initialValue>*</initialValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=os sourcetype="logger" | eval account=ltrim(field10,"[") | eval account=rtrim(account,"]")  |search account="$account$"  |  timechart count by account</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

let me know if this helps!

0 Karma

sathish2k8
Explorer

not working, chart not loading.

0 Karma

mayurr98
Super Champion

i have changed my xml pls check again.
as you are formatting account then the search should be after eval

index=os sourcetype="logger" | eval account=ltrim(field10,"[") | eval account=rtrim(account,"]")  |search account="$account$"  |  timechart count by account

Also after this whenever you enter the text in text box after hitting enter. open in search and see what is getting substituted in the place of account and troubleshoot in that way.

let me know if this helps!

0 Karma

493669
Super Champion

have you tried this:

index=os sourcetype="logger" account="0101010101" | eval account=ltrim(field10,"[") | eval account=rtrim(account,"]")  | timechart count by account 
0 Karma

sathish2k8
Explorer

how it gets input from text box do we need to use append keyword?

0 Karma

493669
Super Champion

if you have input like this in xml:

<form>
   <label>sample</label>
   <fieldset submitButton="false">
     <input type="text" token="account">
       <label>Account</label>
       <initialValue></initialValue>
     </input>
   </fieldset>
 </form>

then you can use token value to search like $account$
then try this:

index=os sourcetype="logger"| eval account=ltrim(field10,"[") | eval account=rtrim(account,"]")  |search account="$account$"| timechart count by account
0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...