Splunk Dev

DBConnect and panel linked form search

ccsfdave
Builder

I can run this search and get results:

index="vpn" host="VPN_ACLs" | join IP_Address [search index="vpn" host="VPN_Groups"] | search Group_Name="DTIS" |table Group_Name,IP_Address,Dest_IP,Dest_Mask,Protocol,Operation,Port

In a form: NOTE: I added spaces so answers markup didn't hide the code

< searchTemplate>
index="vpn" host="VPN_ACLs" | join IP_Address [search index="vpn" host="VPN_Groups"] | search Group_Name=%group% |table Group_Name,IP_Address,Dest_IP,Dest_Mask,Protocol,Operation,Port
< /searchTemplate>
<fieldset>
< input type="text" token="group" >
<label>VPN Group</label>
< default>< /default>
< suffix>*< /suffix>
< /input>

How do I get the %group% into the search correctly?

0 Karma
1 Solution

ccsfdave
Builder

Sorry folks, I'm an idiot.

The variable had % around it in the search not $. Once I changed it to $, it worked perfectly!

View solution in original post

0 Karma

ccsfdave
Builder

Sorry folks, I'm an idiot.

The variable had % around it in the search not $. Once I changed it to $, it worked perfectly!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...