Dashboards & Visualizations

How to add a searchbox to a dashboard?

jrevolorio
Explorer

I've created a dashboard that can help find users based of IP or Host. How do I add a searchbox to this dashboard so I can just enter either a username or IP and find their information? Thanks!

My search: sourcetype=WinEventLog:Security user=* src_nt_host=* | table _time, src_ip user, src_nt_host, host

Each time I try to add an input (text) to do a search for an ip or host it doesn't run the search, not sure if I entered the token correctly? Please advise! Thanks!

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

This is one of the basic Splunk form/dashboard example. What you need is to add the token name that you specified in Textbox in your search. You can use the example show here as reference (the example uses dropdown but token usage will be same)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Buildandeditforms#Basic_form_example

Another good sources of getting examples of various types/usage of Splunk dashboards is https://splunkbase.splunk.com/app/1603/

View solution in original post

niketn
Legend

@jrevolorio, would it be possible to share the code for your textbox input? Also how you are using the token in your search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

This is one of the basic Splunk form/dashboard example. What you need is to add the token name that you specified in Textbox in your search. You can use the example show here as reference (the example uses dropdown but token usage will be same)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Buildandeditforms#Basic_form_example

Another good sources of getting examples of various types/usage of Splunk dashboards is https://splunkbase.splunk.com/app/1603/

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...