Dashboards & Visualizations

Splunk DB Connect: How to create a form input on a dashboard to search a SQL query?

lrolfes
Engager

Hello Splunk Community,

I am probably a 3 out of 10 when it comes to Splunk knowledge. I have connected my database with the DB connect app. I would like to create an app with a form that searches this SQL query:

SELECT to_jid, sent_date, subject, thread_id, msg_type, direction, body_len, message_len, 
body_string, message_string, body_text, message_text, history_flag 
FROM jm 
WHERE from_jid like 'bob@cisco.com%'; 

I would like the user to be able to update the where clause with just an input box because the users do not know SQL so I want to hide that from them.

So basically they open the app > enter a name in the textbox > splunk searches the database and returns the results to the user.

Would anyone have a quick example of doing this?

I appreciate your help!

0 Karma
1 Solution

bandit
Motivator

After creating a dashboard, go into the edit mode and add a text input. It will default to field1. You can reference it as token/variable in another search in your dashboard. i.e. index=my_index $field1$.

View solution in original post

bandit
Motivator

After creating a dashboard, go into the edit mode and add a text input. It will default to field1. You can reference it as token/variable in another search in your dashboard. i.e. index=my_index $field1$.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...