Custom search text box

prad18 — Wed, 26 Jun 2013 12:25:19 GMT

Hi,

I've created custom text box to search the events in splunk.
my xml :

< module name="HiddenSearch" layoutPanel="panel_row3_col1" group="Search field" autoRun="false">
    < param name="search">host=myhost Fieldname=  *$target$*  < /param>

< module name="ExtendedFieldSearch">

    < param name="intention">
          < param name="name">stringreplace < /param>
     < param name="arg">  
         < param name="target">
           < param name="default">500 < /param>
         < /param>
     < /param>

    < /param>

   < param name="replacementMap">

     < param name="arg">
       < param name="target">
         < param name="value"> < /param>
       < /param>
     < /param>

   < /param>

  < param name="field">Test< /param>

< module name="ResultsHeader" layoutPanel="panel_row3_col1" group="splIcon-events-list" altTitle="Events List">
        < param name="entityLabel">events < /param>
        < param name="entityLabelSingular">event < /param> 
        < param name="entityName">events < /param>

     < module name="Export" layoutPanel="panel_row3_col1">
        < param name="exportType">event < /param> 
     < /module> 

     < module name="EnablePreview" group="show" layoutPanel="panel_row3_col1">
        < param name="enable">True < /param>
     < /module>

     < module name="Paginator" layoutPanel="panel_row3_col1">
        < param name="entityName">events < /param>
        < param name="maxPages">10 < /param>

          < module name="EventsViewer"> 
            < param name="displayRowNumbers">True < /param>
            < param name="enableBehavior">True < /param > 
          < /module>
     < /module>

< /module>

  < /module>

< /module>

In UI, it has created a text box with label Test in which user will enter input text to serach.

Initially my query was just host=myhost *$target$* target will have user entered input which will be searched in events and it was working fine and even highlighting the input(which user entered in textbox) in the search result. But when i changed the query from host=myhost *$target$* to host=myhost fieldname = *$target$* it worked but stopped highlighting in search results? How to enable highlighting?
How to validate whether user entered any input or just left text box empty? because right now it is searching even if textbox is empty?

I'm new to splunking. Please help me to resolve these and is there any blog or document to understand the xml used in splunk from scratch, I mean each and every < module > used in xml.

Re: Custom search text box

martin_mueller — Wed, 26 Jun 2013 12:32:59 GMT

Concerning highlighting, take a look at the highlight command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/highlight

Re: Custom search text box

prad18 — Thu, 27 Jun 2013 04:58:37 GMT

Thank you martin.

How can we do validation here?
One more thing is this xml a right one to create search text box ? or should i do it using

Re: Custom search text box

linu1988 — Fri, 05 Jul 2013 08:00:20 GMT

Is it a module? Try defining in there

topic Re: Custom search text box in Splunk Search

Custom search text box

Re: Custom search text box

Re: Custom search text box

Re: Custom search text box