Dashboards & Visualizations

How to add a searchbox to a dashboard?

jrevolorio
Explorer

I've created a dashboard that can help find users based of IP or Host. How do I add a searchbox to this dashboard so I can just enter either a username or IP and find their information? Thanks!

My search: sourcetype=WinEventLog:Security user=* src_nt_host=* | table _time, src_ip user, src_nt_host, host

Each time I try to add an input (text) to do a search for an ip or host it doesn't run the search, not sure if I entered the token correctly? Please advise! Thanks!

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

This is one of the basic Splunk form/dashboard example. What you need is to add the token name that you specified in Textbox in your search. You can use the example show here as reference (the example uses dropdown but token usage will be same)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Buildandeditforms#Basic_form_example

Another good sources of getting examples of various types/usage of Splunk dashboards is https://splunkbase.splunk.com/app/1603/

View solution in original post

niketn
Legend

@jrevolorio, would it be possible to share the code for your textbox input? Also how you are using the token in your search?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

This is one of the basic Splunk form/dashboard example. What you need is to add the token name that you specified in Textbox in your search. You can use the example show here as reference (the example uses dropdown but token usage will be same)

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/Buildandeditforms#Basic_form_example

Another good sources of getting examples of various types/usage of Splunk dashboards is https://splunkbase.splunk.com/app/1603/

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...