Solved: How to split token value and search new values in ...

baty0 · ‎09-13-2018

Hi,

On a dashboard, in a text field box, I would like to be able to give a list of servers in the following format:

server1,server2,server3,server4 etc...

Is it possible to split this list, do a search on a lookuptable and return information for these servers?

For example, the search would be:

|inputlookup ServerInfo.csv
|search HostName=server1 OR HostName=server2 OR HostName=server3 OR HostName=server4

I hope that makes sense

Thanks

renjith_nair · ‎09-13-2018

@baty0 ,
Try below. You need to change the html panel to adapt your dashboard panels.

<form>
  <label>Token Split</label>
  <fieldset submitButton="false">
    <input type="text" token="server_names">
      <label>Server Name</label>
      <change>
        <eval token="splitted_search">"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
      <h1>|inputlookup ServerInfo.csv|search $splitted_search$</h1>
    </html>
  </row>
</form>

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair · ‎09-13-2018

@baty0 ,
Try below. You need to change the html panel to adapt your dashboard panels.

<form>
  <label>Token Split</label>
  <fieldset submitButton="false">
    <input type="text" token="server_names">
      <label>Server Name</label>
      <change>
        <eval token="splitted_search">"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <html>
      <h1>|inputlookup ServerInfo.csv|search $splitted_search$</h1>
    </html>
  </row>
</form>

---
What goes around comes around. If it helps, hit it with Karma 🙂

baty0 · ‎09-13-2018

Thanks you so much for your answer, that worked!
I have one last question.

Would it be possible to detect if there is a space between the server name and make the search still work.

For example:
server1, server2, server3, server4

Thank you

renjith_nair · ‎09-13-2018

you shall remove the space, Please use below

"(hostname=\"".mvjoin(split(replace($value$," ",""),","),"\" OR hostname=\"")."\")"

Updated the answer with the change. Please upvote if it helps!

---
What goes around comes around. If it helps, hit it with Karma 🙂

baty0 · ‎09-13-2018

You're a legend! Thanks

How to split token value and search new values in a lookup table?

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

.conf24 | Personalize your .conf experience with Learning Paths!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...