HI Everyone,
I have multiple text input boxes. I want to achieve the below. there is one panel for each text input.
I have below requirement.
1- initally I dont want to display any panel
2- once I put any data into text input the relevant search panel should show me the result.
below is my code.
<form>
<label>Threat_Intelligance</label>
<description>Include a multiselect input.</description>
<!-- Independent search to set the required filter from comma separated value in text box -->
<!-- For example: www.abc.com,www.xyz.com,www.aaa.com converts to src_ip IN ("www.abc.com","www.xyz.com","www.aaa.com") -->
<search>
<query>| makeresults
| fields - _time
| eval iocFilter=$ioc1|s$
| eval md5Filter=$md5|s$
| eval iocFilter="url IN (\"".replace(iocFilter,",","\",\"")."\")"
| eval md5Filter="process_md5 IN (\"".replace(md5Filter,",","\",\"")."\")"
</query>
<done>
<set token="tokIOCFilter">$result.iocFilter$</set>
<set token="tokmd5Filter">$result.md5Filter$</set>
</done>
</search>
<fieldset autoRun="true" submitButton="true">
<input type="text" token="ioc1" searchWhenChanged="true">
<label>URL</label>
<change>
<condition>
<set token="ioc1">$value$</set>
</condition>
</change>
</input>
<input type="text" token="md5">
<label>md5</label>
<change>
<condition>
<set token="md5">$value$</set>
</condition>
</change>
</input>
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>tokIOCFilter: $tokIOCFilter$</title>
<event>
<search>
<query>index=proxy $tokIOCFilter$ </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
</event>
</panel>
<panel >
<title>tokmd5Filter: $tokmd5Filter$</title>
<event>
<search>
<query> index=edr $tokmd5Filter$ </query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
</form>