Splunk Search

How to create dashboard which takes multiple(bulk) inputs ?

splunkerer
Path Finder

Hello,

I am creating a dashboard, no matter which input can be used, but need is to paste multiple input into dashboard input and search them in a certain index.

for example:
I want to search comma delimited IP addresses such as 

1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4  --->input format is not a case, I can provide different formatted multiple data. 

I want to paste these into input ( no matter which kind) and these will be formatted and created a search in the panel like below.

index=traffic src=1.1.1.1 OR src=2.2.2.2 OR src=3.3.3.3 OR src=4.4.4.4
| table _time src dst port

Please recommend how I can do it.

Thanks,  

Labels (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@splunkerer 

Can you please try this?

index=traffic [| makeresults | eval src="$tkn_src$" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port

 

My Sample Search :

index=traffic [| makeresults | eval src="1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@splunkerer 

Can you please try this?

index=traffic [| makeresults | eval src="$tkn_src$" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port

 

My Sample Search :

index=traffic [| makeresults | eval src="1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
 

splunkerer
Path Finder

Thanks a lot, this is working. In the first try, I provided input with space after the comma, so that is why it was not working. 

0 Karma

splunkerer
Path Finder

Thanks for quick answer, It takes first IP, but not second IP unfortunately. Any idea about the issue? 

 

index=traffic
[| makeresults | eval src="$field1$" | eval src=split(src,",")
| mvexpand src | table src]

| table _time src dst port

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@splunkerer 

It is working for me. Please refer my sample XML.

<form>
  <label>mutiliput</label>
  <fieldset submitButton="false">
    <input type="text" token="field1">
      <label>field1</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" [| makeresults | eval date_second="$field1$" | eval date_second=split(date_second,",") | mvexpand date_second | table date_second] | stats count by date_second</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

Still you to found issue then please share your sample XML as well.

Thanks

KV

Tags (2)

splunkerer
Path Finder

same unfortunately, the first value is taken but not rest of them.

<form>
<label>mutiliput</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index="traffic" [| makeresults | eval src="$field1$" | eval src=split(src,",") | mvexpand src | table src] | table src, dst</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@splunkerer 

Can you please try this?

index="traffic" src=* [| makeresults | eval src="$field1$" | eval src=split(src,",") | mvexpand src | table src] | table src, ds

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...