Dashboards & Visualizations

populate dropdown with meta search on tags ?

sbsbb
Builder

I'm able to make a metasearch on sources for example, but is it also possible to make one on tags, so I could populate a dropdown with the tags I've defined ?

sideview
SplunkTrust
SplunkTrust

You can by using the rest search command. Your users might need admin privileges to run the rest command, but this would work:

| rest /services/search/tags

Here's a really simple self-contained example using Sideview Utils modules to present a simple interface where you can search on one tag at a time and look at the events. Should give you some good ideas.

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">| rest /services/search/tags | fields title</param>

  <module name="Pulldown">
    <param name="name">tag</param>
    <param name="label">Search on a tag:</param>
    <param name="valueField">title</param>
    <param name="template">tag::$value$</param>

    <module name="Search">
      <param name="search">$tag$ | head 1000 </param>

      <module name="Events"></module>
    </module>
  </module>
</module>

Note you would need the latest Sideview Utils app from the Sideview site to run this example ( http://sideviewapps.com ) .

sideview
SplunkTrust
SplunkTrust

Unfortunately my answer may have been a bit too optimistic. I looked into it a bit more, and there are some problems. One problem is that /services/search/tags will only get tags that have been exported to system level. If you want the ones that are still in an app, you need to pick an app, AND pick a username -- "/servicesNS///data/tags". While there are ways to filter them by what fields they're tagged on, I think the requirement to pick both app and username probably takes us out of the world of easy UI answers. So actually I don't think there is a good way.

0 Karma

sbsbb
Builder

I want to search tag::host
With your query, I can only see search tags, is this the same command for source and host tags ?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...