Splunk Search

How to accept multiple value inputs in a Splunk Form?

marquiselee
Path Finder

alt text

So I'm setting up a form/dashboard so that team members can lookup file information. Right now the form can only accept 1 value and thus only return results on the one file. However I'd like like to enable people to enter a comma separated list of values.

e.g. user enters the following fileids into the splunk form, and returns info on all files.
1004043,38945894,8954829,438989233

thoughts?

Tags (3)

jonuwz
Influencer

In advanced XML I've done this in the past :

<module name="ExtendedFieldSearch">
    <param name="field">Comma seperated list</param>
    <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="multi_search">
            <param name="fillOnEmpty">false</param>
            <param name="prefix">
                <![CDATA[[search * | head 1 | eval CL4="]]>
            </param>
            <param name="suffix">
                <![CDATA[" | makemv delim="," CL4 | mvexpand CL4 | fields CL4] ]]>
            </param>
        </param>
    </param>
</param>

So what you're essentially doing is :

[search * | head 1 | eval CL4="your,comma,seperated,list"| makemv delim="," CL4 | mvexpand CL4 | fields CL4]

which will insert :
((CL4=your) OR (CL4=comma) OR (CL4=seperated) OR (CL4=list))

anywhere you specify $multi_search$ in your main search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...