Splunk Search

how to search based on optional text fields?

rarangarajanspl
Explorer

I have couple of text boxes (Tracking no and Track Type) in my bashboard and both are optional.

<fieldset submitButton="true" autoRun="false">
    <input type="text" token="TrackingNo">
      <label>Tracking Number</label>
      <default></default>
      <change>
        <condition value="">
          <set token="TrackingNo">*</set>
        </condition>
      </change>
    </input>
    <input type="text" token="Tracktype">
      <label>Tracktype</label>
      <default></default>
      <change>
        <condition value="">
          <set token="Tracktype">*</set>
        </condition>
      </change>
    </input>
  </fieldset>

Scenario 1: Once the user clicks submit button with out any input, dashboard should display all the data.
Scenario 2: By giving both values, it should fetch all the records exactly matching with Tracking no and Track Type
Scenario 3: By giving only Track no, it should fetch all the records matching with Tracking no, irrespective of Track type (With above simple XML code, track type is supplied as . )
*
Scenario 4:** By giving only Track type, it should fetch all the records matching with Tracking type, irrespective of Track no. (With above simple XML code, Tracking no is supplied as *. )

Please help me to construct the search query

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rarangarajansplunk,
if Track_No and Track_Type are present in all events, you can use " * " as default value.

There's a problem if one of the above fields is missed in some events, because the default condition field=* excludes events without this field (you have this problem in 1, 3 and 4 case).

So, in this second case, (if acceptable for you) you could use a more complicated default values (e.g. Track_Type=* OR NOT Track_Type=* ).

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...