Splunk Search

How to insert a search box in large table of data that is derived from a search on a dashboard?

AKG1_old1
Builder

Hello,

We are using a search which displays data in a table format on a dashboard. As result, the table is too large. I want to create a search box on the primary column of the table so that a specific entry can be extracted from the results.

Regards,
Ankit

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This can be accomplished with SimpleXML..

Change the begining and ends tags to <form>

 <label>Search by IP Address</label>
  <fieldset autoRun="true" submitButton="true">
    <input type="text" token="ip">
      <label>Enter IP Address Here</label>
      <default>*</default>
      <suffix></suffix>
    </input>

We defined the token as ip.. You will then need to pass that token within your query to something like this

<search>
          <query>index=access | search $ip$ | stats dc(index) AS numsources values(index) AS sources count AS "JSession Count" values(IPmain) AS "IP Address" values(WebRequest) AS "Web Request" values(RTG_Browser) AS "User Agent String" BY RTG_JSession |  where numsources=2 | fields "IP Address" "JSession Count" "User Agent String" "Web Request" | sort 0 -count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...