<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic addterm before the original search terms in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83380#M1880</link>
    <description>&lt;P&gt;I am trying to 'reduce' a search scope using addterm :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;module name="HiddenSavedSearch" &amp;gt;
  &amp;lt;param name="savedSearch"&amp;gt;Available machines&amp;lt;/param&amp;gt;
  &amp;lt;module name="ExtendedFieldSearch"&amp;gt;
      &amp;lt;param name="intention"&amp;gt;
         &amp;lt;param name="name"&amp;gt;addterm&amp;lt;/param&amp;gt; 
         &amp;lt;param name="arg"&amp;gt; 
          &amp;lt;param name="clustergroup"&amp;gt;
                &amp;lt;param name="default"&amp;gt;&amp;lt;/param&amp;gt;
            &amp;lt;/param&amp;gt; 
         &amp;lt;/param&amp;gt; 
         &amp;lt;param name="flags"&amp;gt;
         &amp;lt;list&amp;gt;indexed&amp;lt;/list&amp;gt;
         &amp;lt;/param&amp;gt;
    &amp;lt;/param&amp;gt;
&amp;lt;/module&amp;gt;
&amp;lt;/module&amp;gt;                       
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The new 'term' is added to the end of the search 'Avaliable machines', is there a way to added a term to the begining of it, like a search filter ?&lt;/P&gt;

&lt;P&gt;&lt;EM&gt;Ps: I am avoiding 'replace' and a placeholoder on the saved search because its also used without it.&lt;/EM&gt;&lt;/P&gt;</description>
    <pubDate>Thu, 04 Nov 2010 06:15:13 GMT</pubDate>
    <dc:creator>mauhumor</dc:creator>
    <dc:date>2010-11-04T06:15:13Z</dc:date>
    <item>
      <title>addterm before the original search terms</title>
      <link>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83380#M1880</link>
      <description>&lt;P&gt;I am trying to 'reduce' a search scope using addterm :&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;module name="HiddenSavedSearch" &amp;gt;
  &amp;lt;param name="savedSearch"&amp;gt;Available machines&amp;lt;/param&amp;gt;
  &amp;lt;module name="ExtendedFieldSearch"&amp;gt;
      &amp;lt;param name="intention"&amp;gt;
         &amp;lt;param name="name"&amp;gt;addterm&amp;lt;/param&amp;gt; 
         &amp;lt;param name="arg"&amp;gt; 
          &amp;lt;param name="clustergroup"&amp;gt;
                &amp;lt;param name="default"&amp;gt;&amp;lt;/param&amp;gt;
            &amp;lt;/param&amp;gt; 
         &amp;lt;/param&amp;gt; 
         &amp;lt;param name="flags"&amp;gt;
         &amp;lt;list&amp;gt;indexed&amp;lt;/list&amp;gt;
         &amp;lt;/param&amp;gt;
    &amp;lt;/param&amp;gt;
&amp;lt;/module&amp;gt;
&amp;lt;/module&amp;gt;                       
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;The new 'term' is added to the end of the search 'Avaliable machines', is there a way to added a term to the begining of it, like a search filter ?&lt;/P&gt;

&lt;P&gt;&lt;EM&gt;Ps: I am avoiding 'replace' and a placeholoder on the saved search because its also used without it.&lt;/EM&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 04 Nov 2010 06:15:13 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83380#M1880</guid>
      <dc:creator>mauhumor</dc:creator>
      <dc:date>2010-11-04T06:15:13Z</dc:date>
    </item>
    <item>
      <title>Re: addterm before the original search terms</title>
      <link>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83381#M1881</link>
      <description>&lt;P&gt;No. You will need to use the stringreplace intention to do this. You may be able to replace the placeholder with an empty string, depending on what input type you are using.&lt;/P&gt;</description>
      <pubDate>Thu, 04 Nov 2010 06:34:42 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83381#M1881</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-11-04T06:34:42Z</dc:date>
    </item>
    <item>
      <title>Re: addterm before the original search terms</title>
      <link>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83382#M1882</link>
      <description>&lt;P&gt;That empty string trick did it. Thanks!&lt;/P&gt;</description>
      <pubDate>Thu, 04 Nov 2010 22:30:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83382#M1882</guid>
      <dc:creator>mauhumor</dc:creator>
      <dc:date>2010-11-04T22:30:56Z</dc:date>
    </item>
    <item>
      <title>Re: addterm before the original search terms</title>
      <link>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83383#M1883</link>
      <description>&lt;P&gt;Actually the &lt;OBJECT&gt;&lt;PARAM name="flags" /&gt;&lt;LIST&gt;indexed&lt;/LIST&gt; should be doing exactly that -- forcing addterm to add to the initial search clause.  Strange that it wasnt doing that.&lt;/OBJECT&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 05 Nov 2010 00:31:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/addterm-before-the-original-search-terms/m-p/83383#M1883</guid>
      <dc:creator>sideview</dc:creator>
      <dc:date>2010-11-05T00:31:18Z</dc:date>
    </item>
  </channel>
</rss>

