topic Re: Link to download source files in Getting Data In

Link to download source files

oscargarcia — Tue, 12 Apr 2011 04:13:33 GMT

Hi,

We have a system with many indexed small xml files. Is it possible to have a link/view that displays the full content of all the matches in a search?

Thanks!

Re: Link to download source files

jamesaarondevli — Tue, 12 Apr 2011 13:10:56 GMT

Hi Oscar,

what you might be able to do is construct a search which produces a link to a page displaying the raw xml for each search result. This could be achieved by using the addinfo command in combination with eval to produce the URL.

Check out this doco, it will give you an idea of how splunk out of the box allows you to view the source for an event. Using that understanding you might be able to achieve what I described above (might, as in I've never tried this myself).

Use addinfo in your search to produce the info_search_id
Construct a URL using eval similar to the following: eval linktoSource="https://URL:8000/en-US/app/APPNAME/show_source?sid=".info_search_id."&offset=0&latest_time="
The result of that eval should be a URL pointing to the raw source of that event. The source for that event should be highlighted.

If this isn't what you're after I hope it gets you on the right track.

Cheers, James

Re: Link to download source files

oscargarcia — Mon, 28 Sep 2020 09:27:40 GMT

Many thanks, it works with just a simple change, instead of info_search_id, you have to use info_sid.

It is a bit weird, as the documentation clearly states what you mention, but info_search_id is not available in my search results...