topic Re: make indexer easy accessable in Getting Data In

make indexer easy accessable

nebel — Fri, 30 Nov 2012 14:51:06 GMT

Hi,

people often don't like it to use "index=...". I've tried to make logs easy accessable for them by using macros instead.

For example firewall-logs.

But now people wan't to have a more easier way, without ``. Is there a way to just use a single word for choosing an index in the background? For example just the word "firewall" ?

With tags and eventtypes it is the same. You have to use "tag=...".

Thank you in advance

Regards

Re: make indexer easy accessable

Drainy — Fri, 30 Nov 2012 14:58:14 GMT

Nope, there is no easier way. I would argue that the `` are pretty easy anyway. Any word entered without these characters would just be interpreted as a search term or command.

Oh, there is the other option of adding it to the indexes their role search by default? It depends on the use case and their roles really. But it is another option if they really are concerned about typing in an additional 2 characters 😉

Re: make indexer easy accessable

nebel — Fri, 30 Nov 2012 15:03:54 GMT

thank you! is it possible to create a new button next to the "save" and "create" button which solves this problem? should be not a problem, or?

Re: make indexer easy accessable

Drainy — Fri, 30 Nov 2012 15:11:19 GMT

Create a button to search against an index?

Re: make indexer easy accessable

nebel — Fri, 30 Nov 2012 15:14:17 GMT

create a button which adds for a existing search a kind of suffix.

normal search : index= abc
click to button : index = abc OR index = cde

all stuff after index = abc comes from the button.

possible?

Re: make indexer easy accessable

Drainy — Fri, 30 Nov 2012 15:22:10 GMT

err, possibly. This would be moving from the realms of Splunk and more into JavaScript and populating text fields with values based on click events. I still think its a matter of user education. The most common searches and investigations should be in savedsearches or dashboards. You could build custom forms for specific indexes where the index is hidden in the background and users just enter their search terms. You could even add a drop down to the left to select an index first if you really just wanted the one screen.

Re: make indexer easy accessable

MHibbin — Fri, 30 Nov 2012 17:34:53 GMT

Create you own flashtimeline and include the indexes as a dropdown...

This would allow to have a free text box for the search string, and then have a dropdown that includes a list of indexes that users can search on.

Perhaps a bit "radical" but hey-ho...

Good starting points:

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/AdvancedSearch

Just an idea, but hope it helps.