I am using Splunk to create a dashboard. I added a report to the dashboard that returns all of the data from the search into a table. I want to add a few input fields so the user to option to filter the data of the report. The first input is a textbox field. The default and initial values are set to with an *. That I hope means everything. This is the xml created from the dashboard:
<form>
<label>Thru Train Dashboard</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
<label>TMS Reference Number</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Thru Train XML DATA</title>
<table>
<search ref="ThruTrainReportNestedResults"></search>
<option name="drilldown">row</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
</form>
I know I have to use the token value purchCostReferenceToken as an input to the report ThruTrainReportNestedResults. But not sure how to do that since the report search as no input parameters.
This is the search query that creates the report, ThruTrainReportNestedResults
sourcetype... | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments = mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time
Is there a way to filter the results of this query from a dashboard using input data? The input data that I would want to filter on would be the purchCostReference, eventType, and Segments
UPDATE I removed the reference to the report and added the search string that creates the report but am getting the error Invalid character in tag name. The search string is very long...
<row>
<panel>
<title>Thru Train XML DATA</title>
<table>
<search base="baseSearch">
<query>
index... sourcetype="..." "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments = mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time
</query>
</search>
<option name="drilldown">row</option>
<option name="rowNumbers">true</option>
</table>
</panel>
</row>
UPDATE I encoded the search query and added between the query tags with the token element as described in a previous comment. I do not get an error but get no results either. Just a blank table...
<query> ...sourcetype%....%22%20%22%3CbillingMethod%3ERULE%3C%2FbillingMethod%3E%22%20%22createMessage%20MsgSource%22%20%7C%20xmlkv%20%7C%20rex%20max_match%3D0%20%22%5C%3CpurchasedCostTripSegment%5C%3E%28%3FP%3Csegment%3E%5B%5E%5C%3C%5D%2B%29%22%20%7Ceval%20Segments%20%3D%20%20mvrange%281%2Cmvcount%28mvindex%28segment%2C%200%2C%202%29%29%2B1%2C1%29%20%7C%20rex%20max_match%3D0%20%22%5C%3Ccarrier%5C%3E%28%3FP%3CCarriers%3E%5B%5E%5C%3C%5D%2B%29%22%20%7C%20rex%20max_match%3D0%20%22%5C%3CbillingMethod%5C%3E%28%3FP%3CBillingMethod%3E%5B%5E%5C%3C%5D%2B%29%22%20%7C%20rex%20max_match%3D0%20%22%3CpurchasedCostTripSegment%3E%5B%5Cs%5CS%5D%2A%3F%3Corigin%3E%5Cs%2A%3Cns2%3AnumberCode%3E%28%3FP%3COrigin%3E%5Cd%2B%29%22%20%20%7C%20rex%20max_match%3D0%20%22%3CpurchasedCostTripSegment%3E%5B%5Cs%5CS%5D%2A%3F%3Cdestination%3E%5Cs%2A%3Cns2%3AnumberCode%3E%28%3FP%3CDestination%3E%5Cd%2B%29%22%20%7C%20rex%20max_match%3D0%20%22%3CpurchasedCostTripSegment%3E%5B%5Cs%5CS%5D%2A%3F%3CstopOff%3E%5Cs%2A%3Cns2%3AstopOffLocation%3E%5Cs%2A%3Cns2%3AnumberCode%3E%28%3FP%3CStopOffLocation%3E%5Cd%2B%29%22%20%7C%20eval%20Time%20%3D_time%20%7C%20convert%20timeformat%3D%22%25m-%25d-%25Y%20%25H%3A%25M%3A%25S%22%20ctime%28Time%29%20%7C%20table%20purchCostReference%2C%20eventType%2C%20Time%2C%20Segments%2C%20Carriers%2C%20BillingMethod%2C%20Origin%2C%20Destination%2C%20StopOffLocation%20%7C%20sort%20Time purchCostReference=$purchCostReferenceToken$
</query>
This is a screen shot of the results:
UPDATE I removed the complexity of the search so that it only has the index, source and sourcetype that is the same as the report and a text field to limit the search. Below is the query string:
<query>index="indexname same as report" source="source name same as report" sourcetype="source type name same as report" "createMessage MsgSource"</query>
It returns a blank dashboard with no error as pictured above.
UPDATE I recreated the dashboard using the report query and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: purchCostReferenceToken
I want to limit the table results based on this token. This is the query:
<form>
<label>Thru Train Dashboard</label>
<fieldset submitButton="false" autoRun="true">
<input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
<label>Enter a TMS Reference Number to Filter Table</label>
<default>*</default>
<initialValue>*</initialValue>
</input>
</fieldset>
<row>
<panel>
<title>Thru Train Data</title>
<table>
<search>
<query>index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments = mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time</query>
<earliest>-30d@d</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
</form>
Where do I add the token to limit the search? I tried adding this to the end of the query and all results were returned:
purchCostReference=$purchCostReferenceToken$
