topic Re: Form Creation, Wildcard use in Splunk Search

Form Creation, Wildcard use

jsb22 — Mon, 28 Sep 2020 11:37:49 GMT

Essentailly I'm trying to create a form that uses a wildcard by default so users can just hit search on page load and get all values of the field, then the user can input specific values in the field so they can limit what they're seeing. When I specify "< default>*< /default>" it errors out with "Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side". THe fieldset and searchTemplate stream is as follows:

< fieldset>
< input type="text" token="Administrator" />
< default>*< /default>
< /fieldset>

< searchTemplate>(index=windows_7 OR index=windows_2008_R2) source=wineventlog:security EventCode=4720 src_user=$Administrator$ | table _time, src_user, host, dest_nt_domain, signature, user, Display_Name< /searchTemplate>

Re: Form Creation, Wildcard use

MHibbin — Thu, 05 Apr 2012 14:03:09 GMT

I may be missing something but I don't know why you have to used \ in your search string..

You can use HTML characters (link here) or you can encase your search in CDATA brackets. However I do not see any of these special characters in your XML.

I have put a working form example in the comment below (for some reason I couldn't get it to appear in answer correctly.. even with "Code Sample" or backticks).

Alos notice I have encased $SRC$ in *'s, this allows for wildcarding on text entered.

Regards,

MHibbin

Re: Form Creation, Wildcard use

MHibbin — Thu, 05 Apr 2012 14:03:26 GMT

Re: Form Creation, Wildcard use

MHibbin — Thu, 05 Apr 2012 14:22:04 GMT

Ha! Ok... I just edited answer... was having some issues getting Splunkbase to allow my XML... kept creating a form input in the answer!!! 😄

Re: Form Creation, Wildcard use

MHibbin — Mon, 28 Sep 2020 11:37:51 GMT

Also to add in for others... the CDATA syntax would be

<![CDATA[search_string_here]]>

Re: Form Creation, Wildcard use

jsb22 — Thu, 05 Apr 2012 14:28:51 GMT

Turns out it was the escape character, I tested that before, and it didn't work, tested again to try to digest what the CDATA statement does and it worked, must have fat-fingered it somewhere. So my origional code was correct except for the escape character you recommended. Thanks again!

Re: Form Creation, Wildcard use

MHibbin — Thu, 05 Apr 2012 14:35:30 GMT

Great News!!