topic Re: Leading Pipe Search and forms in All Apps and Add-ons

Leading Pipe Search and forms

rmcdougal — Thu, 13 Dec 2012 19:06:28 GMT

I know that saved search macros have difficulties with leading pipes but what about forms? The reason I ask is I am attempting to create a form and I am finding it doesn't work.

Here is my form XML

<form>
  <label>AD Search</label>
  <searchTemplate><![CDATA[ |ldapsearch domain=AD search="(&(objectClass=user)(sAMAccountName=$username$))" | table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate]]>
    </searchTemplate>
  <fieldset>
      <input type="text" token="username" />
  </fieldset>
  <row>
      <event>
            <title>Results</title>
            <option name="count">50</option>
      </event>
  </row>
</form>

Re: Leading Pipe Search and forms

lguinn2 — Thu, 13 Dec 2012 21:35:52 GMT

Have you written a custom command named ldapsearch? If so, it's probably something about the settings for that command.

If you haven't, then you shouldn't be starting your searchTemplate string with a |

Re: Leading Pipe Search and forms

rmcdougal — Thu, 13 Dec 2012 21:38:38 GMT

I am using the SA-ldapsearch app

http://splunk-base.splunk.com/apps/55754/splunk-support-for-active-directory

Re: Leading Pipe Search and forms

lguinn2 — Thu, 13 Dec 2012 21:41:15 GMT

That's pretty important for the rest of us to know!

Re: Leading Pipe Search and forms

ahall_splunk — Mon, 17 Dec 2012 15:06:20 GMT

What version of Splunk are you using?

I'm also having an issue with v5.0.1 Simple XML - it doesn't like spaces at the beginning of the pipeline, so you may want to try removing that space at the start of your searchTemplate block.

Re: Leading Pipe Search and forms

ericrobinson — Mon, 17 Jun 2013 17:36:32 GMT

Anyone get an answer to this pipe question? It is also dropping for me as part of a form search

Re: Leading Pipe Search and forms

ahall_splunk — Mon, 17 Jun 2013 17:56:28 GMT

Firstly, remove the space from the beginning of the search. Secondly, you have not specified an earliest and latest - even though the search does not care what these are, they still need to be present. The search will not be dispatches without them.