Splunk Search

How to insert a search box in large table of data that is derived from a search on a dashboard?

AKG1_old1
Builder

Hello,

We are using a search which displays data in a table format on a dashboard. As result, the table is too large. I want to create a search box on the primary column of the table so that a specific entry can be extracted from the results.

Regards,
Ankit

0 Karma

skoelpin
SplunkTrust
SplunkTrust

This can be accomplished with SimpleXML..

Change the begining and ends tags to <form>

 <label>Search by IP Address</label>
  <fieldset autoRun="true" submitButton="true">
    <input type="text" token="ip">
      <label>Enter IP Address Here</label>
      <default>*</default>
      <suffix></suffix>
    </input>

We defined the token as ip.. You will then need to pass that token within your query to something like this

<search>
          <query>index=access | search $ip$ | stats dc(index) AS numsources values(index) AS sources count AS "JSession Count" values(IPmain) AS "IP Address" values(WebRequest) AS "Web Request" values(RTG_Browser) AS "User Agent String" BY RTG_JSession |  where numsources=2 | fields "IP Address" "JSession Count" "User Agent String" "Web Request" | sort 0 -count</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...