Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Splunk Text Input

$
0
0
Hi, I have a dashboard. It has 3 text inputs. Search by IP Text Input 1 Search by NETBIOS Text Input 2 Search by DNS Text Input 3 Submit button I have a statistical table panel below them that is running the query: Base search/Report reference | search IP="$ip$" OR NETBIOS="$netbios$" OR DNS="$dns$" | stats dc(IP) AS Total BY IP, NETBIOS, DNS When I have IP inserted, Submit returns IP, NETBIOS and DNS. When I have different NETBIOS inserted, search returns NETBIOS + IP (both different, one result for IP and one for NETBIOS. Likewise if I have all three different values, I will have three results) What I need: - Once any value is inserted, I want the other two to reset and become blank so search can use only one value at a time. I need to use either of the three values from text box inputs above and have only one result from one of either of three values. For example, if I insert an IP 00.00.00.00 and hit Submit, I get results for IP since other two values are left blank. But when I insert NETBIOS e.g. SAMPLENETBIOS, I want IP text box to become reset/blank and search result should return results for NETBIOS not IP. Likewise for DNS. Or can I have one text box where any one of three values can be inserted to get desired results? How? Thanks in-advance I am on v6.6.5 and +

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>