Splunk Search

search for a string containing any substring that is typed in the text input

anooshac
Communicator

Hi all,

I have a text input for a table header. My requirement is , by default the table should show all the values and if any letters typed in the text box, the same should match with the table header and the values containing that sub string should be displayed. I created the text box but haven't figured out how to match this sub string to the header. Please help me in this..

Labels (1)
Tags (3)
0 Karma

aasabatini
Motivator

Hi @anooshac 

 

can you share your dashboard or your search?

 

with this info we can help you better

 

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

anooshac
Communicator

This input is to type the sub string.Default value should be all data. The search string can contain 1 or more letters, it should match the task _name in the query below and produce the table for the same.

<input type="text" token="Tok_task">
<label>Task Name</label>
</input>

The query used for table is(since i cannot write the actual query here I have used examples),

index= "abc" sourcetype="xyz"| rex field=URL "(?&lt;http&gt;[^/]*)://(?&lt;group_name&gt;[^/]*)/(?&lt;project_name&gt;[^/]*)/(?&lt;task_name&gt;[^/]*)"| table task_name URL project_name group_name

I tried to add the token from input directly in the query, but it is not working. Can you please help with this one?

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...