Hello,
I am creating a dashboard, no matter which input can be used, but need is to paste multiple input into dashboard input and search them in a certain index.
for example:
I want to search comma delimited IP addresses such as
1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4 --->input format is not a case, I can provide different formatted multiple data.
I want to paste these into input ( no matter which kind) and these will be formatted and created a search in the panel like below.
index=traffic src=1.1.1.1 OR src=2.2.2.2 OR src=3.3.3.3 OR src=4.4.4.4
| table _time src dst port
Please recommend how I can do it.
Thanks,
Can you please try this?
index=traffic [| makeresults | eval src="$tkn_src$" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port
My Sample Search :
index=traffic [| makeresults | eval src="1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Can you please try this?
index=traffic [| makeresults | eval src="$tkn_src$" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port
My Sample Search :
index=traffic [| makeresults | eval src="1.1.1.1, 2.2.2.2, 3.3.3.3, 4.4.4.4" | eval src=split(src,",") | mvexpand src | table src] | table _time src dst port
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Thanks a lot, this is working. In the first try, I provided input with space after the comma, so that is why it was not working.
Thanks for quick answer, It takes first IP, but not second IP unfortunately. Any idea about the issue?
index=traffic
[| makeresults | eval src="$field1$" | eval src=split(src,",")
| mvexpand src | table src]
| table _time src dst port
It is working for me. Please refer my sample XML.
<form>
<label>mutiliput</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index="_internal" [| makeresults | eval date_second="$field1$" | eval date_second=split(date_second,",") | mvexpand date_second | table date_second] | stats count by date_second</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Still you to found issue then please share your sample XML as well.
Thanks
KV
same unfortunately, the first value is taken but not rest of them.
<form>
<label>mutiliput</label>
<fieldset submitButton="false">
<input type="text" token="field1">
<label>field1</label>
<default>*</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index="traffic" [| makeresults | eval src="$field1$" | eval src=split(src,",") | mvexpand src | table src] | table src, dst</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Can you please try this?
index="traffic" src=* [| makeresults | eval src="$field1$" | eval src=split(src,",") | mvexpand src | table src] | table src, ds
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.