Dashboards & Visualizations

how to add a search box on a dashboard

japposadas
Explorer

Hi Splunkers, I just wanna ask if anyone has done this. I wanted to a add splunk search bar like this to my dashboard.
alt text

how to add it? Do I need to add it by using script or i just need to call it? thanks in advance!

Tags (2)
0 Karma

mayurr98
Super Champion

hey try this run anywhere XML

<form>
  <label>Text Form Input Element</label>
  <description>Set search terms by populating a form with textbox input.</description>
  <fieldset autoRun="true" submitButton="true">
    <input type="time" token="field1" searchWhenChanged="true">
      <label>Time Picker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="keyword" searchWhenChanged="true">
      <label>Enter Text</label>
      <default>*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>raw logs for $keyword$</title>
        <search>
          <query>index=_internal $keyword$</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

For example. you can try searching for ERROR keyword in your _internal logs

let me know if this helps !

0 Karma

493669
Super Champion

Hi @japposadas,
You can add text input and set a token for it as below:

<input type="text" token="tokenname" searchWhenChanged="true">
   <label>Enter a search</label>
   <suffix></suffix>
 </input>
     </fieldset>

 <panel>
   <table>
     <search>
       <query>index="indexname"  field=$tokenname$ 
       </query>
     </search>

use the $tokenname$ token in your search as required.
Hope this helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...