how to create a search bar in a dashboard?

[clairebesson]

Hi guys, Thanks for reading this question.
I have a dashboard on which I display several fields in a table as you can see in the figure below:

I want to create a search bar on which I can do “Search by Field1/Field2/Field3 …”

For example I want to search by Location and I know the name of the city. I want to be able to do: Search by “Location” and I can write “Paris”.

Could you please help me with that?
Thanks in advance

[pradeepkumarg · Accepted solution]

Read about form inputs here
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Overviewofdashboards
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/Buildandeditforms

Download the examples app which explains most of the use cases clearly
http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/ExamplesApp

[clairebesson]

Thanks for the help. I have read this documentation.
So, I have added a text input and a submit button. I want to write the serial number and then, I want that my dashboard displays my search. However, I have a problem with my search. I don't know how to precise $Serial Number$ in my serach.

<input type="text" token="Serial Number" searchWhenChanged="true">
  <label>Enter a Serial Number</label>
  <suffix></suffix>
</input>
    </fieldset>

<panel>
  <table>
    <search>
      <query>source="aruba 103 rma units.csv" | top limit=100 "Serial Number"
      </query>
    </search>

thank you in advance

[maciep]

First off, I typically don't put spaces in my token names, but I guess it's allowed? Anyway, the idea here is that the value typed into that text box gets stored in the token field. You then use that token field in your search like a variable.

This isn't tested obviously but hopefully it gives you a better idea.

 <input type="text" token="serial_number_token" searchWhenChanged="true">
   <label>Enter a Serial Number</label>
   <suffix></suffix>
 </input>
     </fieldset>

 <panel>
   <table>
     <search>
       <query>source="aruba 103 rma units.csv" 'Serial Number'=$serial_number_token$ 
       </query>
     </search>

[clairebesson]

maybe you could help me with another thing. Thanks to your help I am able to search a serial number with the text input.
I have created another text input to search by purchase order.
I wanted to create a dropdown "Search by": - Serial Number / - Purchase Order
If the user choose "Search by Serial Number" he could write the number in the text input that I have created.

I tried to add a condition but it doesn't work. I don't know at all how do that (Splunk very beginner)

  <input type="dropdown" >
    <label>Search by</label>
    <default>*</default>
    <choice value="Serial Number">Serial Number</choice>
    <choice value="Purchase Order">Purchase Orderc</choice>

    <change>
      <condition value="Serial Number">

         <input type="text" token="serial_number_token" searchWhenChanged="true">
  <label>Enter a SN</label>
  <default>*</default>
  <suffix></suffix>
</input>
      </condition>
      <condition value="Purchase Order">

          <input type="text" token="purchase_order_token" searchWhenChanged="true">
  <label>Enter a PO</label>
  <default>*</default>
  <suffix></suffix>
</input>

      </condition>
    </change>
<panel>
  <table>
    <search>
      <query>source="aruba 103 rma units.csv" "Serial Number"=$serial_number_token$ "Purchase Order"=$purchase_order_token$ "</query>

Thanks again !

[clairebesson]

Thank you very much! It helps a lot !