Dashboards & Visualizations

How to add a searchbox to a dashboard?

jrevolorio
Explorer

I've created a dashboard that can help find users based of IP or Host. How do I add a searchbox to this dashboard so I can just enter either a username or IP and find their information? Thanks!

My search: sourcetype=WinEventLog:Security user=* src_nt_host=* | table _time, src_ip user, src_nt_host, host

Each time I try to add an input (text) to do a search for an ip or host it doesn't run the search, not sure if I entered the token correctly? Please advise! Thanks!

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

This is one of the basic Splunk form/dashboard example. What you need is to add the token name that you specified in Textbox in your search. You can use the example show here as reference (the example uses dropdown but token usage will be same)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Buildandeditforms#Basic_form_example

Another good sources of getting examples of various types/usage of Splunk dashboards is https://splunkbase.splunk.com/app/1603/

View solution in original post

niketnilay
Legend

@jrevolorio, would it be possible to share the code for your textbox input? Also how you are using the token in your search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

This is one of the basic Splunk form/dashboard example. What you need is to add the token name that you specified in Textbox in your search. You can use the example show here as reference (the example uses dropdown but token usage will be same)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Buildandeditforms#Basic_form_example

Another good sources of getting examples of various types/usage of Splunk dashboards is https://splunkbase.splunk.com/app/1603/

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!