How to send "NOT <something>" in a form search field

[jamesdon]

When I attempt to do this, I get the following error:

Error in 'UnifiedSearch': Unable to parse the 'Invalid RHS for comparison' search.

Is there a way to accomplish this using a form search?

jim

---

from thartmann:

Ala Jim 🙂 Here's the XML we're working on... and as you stated, it will not work as is. Should I add a drop down that contains "*" or "NOT" in between the field=$something$? That might get pretty busy, since I already have a lot of fields.

  <searchTemplate>sourcetype=smartsAlerts service_class=$service_class$ group_owner=$group_owner$ element_name=$element_name$ element_class=$element_class$ event=$event$ | transaction name=active_alerts | search active=$active$</searchTemplate>

  <fieldset autoRun="true">
      <!-- the default is a text box, with no seed value; if user does not input a value, then the $from$ token in searchTemplate will be removed -->
      <input type="text" token="service_class">
        <label>service class</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="group_owner">
        <label>group owner</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="element_class">
        <label>element class</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="element_name">
        <label>element name</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="event">
        <label>event</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="dropdown" token="active">
        <populatingSavedSearch fieldForValue="active" fieldForLabel="active"><![CDATA[drop down active]]></populatingSavedSearch>
        <label>active?</label>
        <choice value="true OR false">Both</choice>
        <default>true</default>
        <seed>true</seed>
      </input>
      <input type="time" />
  </fieldset>

[thartmann]

Ala Jim 🙂 Here's the XML we're working on... and as you stated, it will not work as is. Should I add a drop down that contains "*" or "NOT" in between the field=$something$? That might get pretty busy, since I already have a lot of fields.

  <searchTemplate>sourcetype=smartsAlerts service_class=$service_class$ group_owner=$group_owner$ element_name=$element_name$ element_class=$element_class$ event=$event$ | transaction name=active_alerts | search active=$active$</searchTemplate>

  <fieldset autoRun="true">
      <!-- the default is a text box, with no seed value; if user does not input a value, then the $from$ token in searchTemplate will be removed -->
      <input type="text" token="service_class">
        <label>service class</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="group_owner">
        <label>group owner</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="element_class">
        <label>element class</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="element_name">
        <label>element name</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="text" token="event">
        <label>event</label>
        <default>*</default>
        <seed>*</seed>
      </input>
      <input type="dropdown" token="active">
        <populatingSavedSearch fieldForValue="active" fieldForLabel="active"><![CDATA[drop down active]]></populatingSavedSearch>
        <label>active?</label>
        <choice value="true OR false">Both</choice>
        <default>true</default>
        <seed>true</seed>
      </input>
      <input type="time" />
  </fieldset>

[gkanapathy · Accepted solution]

For the text input fields, if you simply don't provide a default, Splunk will replace the term with an empty string. But I suppose you want the user to be able to type NOT whatever in their text box, and have that become NOT field="whatever"?

The quick and dirty solution is to define a macro:

[expand_NOT(2)]
args = f v
iseval = true
definition = replace("$v$","^(NOT )?.*","\1")."$f$=".replace("$v$","^(?:NOT )?(.*)","\1")

And change your search template to use that instead:

sourcetype=smartsAlerts 
  `expand_NOT(service_class,$service_class$)` 
  `expand_NOT(group_owner,$group_owner$)` 
  `expand_NOT(element_name,$element_name$)` 
  `expand_NOT(element_class,$element_class$)` 
  `expand_NOT(event,$event$)` 
| transaction name=active_alerts 
| search `expand_NOT(active,$active$)`

This won't let you deal with things like someone entering xxx OR yyy in the search box though, so it's not really that neat, and the users need to know to enter NOT for negation.

I'd say the tidy solution is adding a radio or dropdown next to or after the field to let the user negate it instead. This does get admittedly messy, which isn't helped by the difficultly of controlling the exact layout of the form fields.

[Lowell]

You'll have to provide the full combined search. There is no reason why you can't do this, assuming that the resulting search is valid.

For example, if you search template is:

 sourcetype=my_type $extraterms$

This would work fine, but if your search template is:

sourcetype=my_type field=$extraterms$

then this would expand to:

sourcetype=my_type field=NOT something

which isn't going to do what you want.

If you post your form then more-specific recommendations can be made.