topic Re: Custom Search Lite app in Splunk Search

Custom Search Lite app

nickstone — Fri, 13 Jun 2014 07:02:30 GMT

I have an odd requirement where I want to limit the index, source or sourcetype for my end users.

I have had a quick go at building my own "Search" app using: http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedSearch
and advancedxml.

Ideally, I would like it to be SimpleXML, but can live with advancedxml.

The functionality needs to allow me to prepend all searches with some static hidden search (ie index=main | )

Pretty sure I have seen this before and would like to avoid the use of an external framework.

thanks!

Re: Custom Search Lite app

Ayn — Fri, 13 Jun 2014 10:37:03 GMT

Is this filtering to be done on a per-user or per-role level? If so you can just create search filters that are automatically applied for each user or role that you specify. This can be set in the access controls section for each user or role in the manager.

Re: Custom Search Lite app

lmyrefelt — Tue, 17 Jun 2014 11:26:52 GMT

I dont belive it is possible with simple XML.
In splunk 6 using flashtimeline view under;

True

You can add;

 <module name="HiddenIntention">
   <param name="intention">
     <param name="name">addterm</param>
     <param name="arg">
       <param name="index">MyHiddenIndex</param>
     </param>
    </param>

However you are better of trying to use the new webframework and ( i assume, havent really done it yet) creating your own django-template with search terms, like in advanced xml / flashtimeline )

Hope it helps! 🙂