topic Add hidden search string to flashtimeline view in Splunk Search

Add hidden search string to flashtimeline view

christian_l — Thu, 15 Aug 2013 11:28:01 GMT

Hi there,

I'd like to modify the default search form of Splunk (flashtimeline view) for a new app.
Therefore I'd like to add some search-strings to the search-field. These search-strings shouldn't be seen by the user. I think this would be a task for HiddenIntention module but read this module is deprecated, so I don't want to use it for a new app.
How can the task be done without the HiddenIntention module?

Regards,
Christian

Re: Add hidden search string to flashtimeline view

sowings — Thu, 15 Aug 2013 17:20:23 GMT

In the near term, you could certainly continue to use an intention; I've done this for precisely the reasons you describe. I placed an addterm intention in a local/ copy of the flashtimeline view for my app. Below is the module block I used:

<module name="ConvertToIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="index">test-*</param> </param> </param>

I placed this as a child of my <SubmitButton>, and closed the tags appropriately.