Leading Pipe Search and forms

[rmcdougal]

I know that saved search macros have difficulties with leading pipes but what about forms? The reason I ask is I am attempting to create a form and I am finding it doesn't work.

Here is my form XML

<form>
  <label>AD Search</label>
  <searchTemplate><![CDATA[ |ldapsearch domain=AD search="(&(objectClass=user)(sAMAccountName=$username$))" | table sAMAccountName,personalTitle,displayName,givenName,sn,suffix,mail,telephoneNumber,mobile,manager,priority,department,category,watchlist,whenCreated,endDate]]>
    </searchTemplate>
  <fieldset>
      <input type="text" token="username" />
  </fieldset>
  <row>
      <event>
            <title>Results</title>
            <option name="count">50</option>
      </event>
  </row>
</form>

[ahall_splunk]

Firstly, remove the space from the beginning of the search. Secondly, you have not specified an earliest and latest - even though the search does not care what these are, they still need to be present. The search will not be dispatches without them.

[ericrobinson]

Anyone get an answer to this pipe question? It is also dropping for me as part of a form search

[ahall_splunk]

What version of Splunk are you using?

I'm also having an issue with v5.0.1 Simple XML - it doesn't like spaces at the beginning of the pipeline, so you may want to try removing that space at the start of your searchTemplate block.

[lguinn2]

That's pretty important for the rest of us to know!

[rmcdougal]

I am using the SA-ldapsearch app

http://splunk-base.splunk.com/apps/55754/splunk-support-for-active-directory

[lguinn2]

Have you written a custom command named ldapsearch? If so, it's probably something about the settings for that command.

If you haven't, then you shouldn't be starting your searchTemplate string with a |