Re: xml problem, can't get right results....

riderofyamaha · ‎07-06-2010

I'm having a problem with getting simple xml working on a form search that is meant to be used searching for a username or specific ip address. The search should be used to find out certain attributes and group them in a table like pool ip, time, host etc. This should be fairly straight forward but im having problems with the searches not bringing back complete results and sometimes just showing the host and time in the results table. the xml so far is as follows, im sure there is something that im over looking though...

 <form> <label>Search ME</label> <searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net)       

 $SearchHere$ | fields + host, username, ip, _time, vpn_poolip </searchTemplate> <earliestTime>-     
 30d</earliestTime> <latestTime>-0d</latestTime> <html> Enter a sourcetype in the field below 

 and this view will pull back the most recent 100 events from the metrics log concerning that 

 sourcetype. </html> <fieldset> <input token="SearchHere" /> </fieldset> <row> <table> 

 <title>activity</title> <option name="count">50</option> </table> </row> <fields>_raw</fields> 

 </form>



 suggestions?

Lowell · ‎07-06-2010

Seems like there are a couple of tags in the wrong place. Specifically <html> and <fields>, but there could still be other problems. But I think this is a step in the right direction for you:

<?xml version="1.0"?>
<form>
  <label>Search ME</label>
  <searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net) $SearchHere$ | fields + host, username, ip, _time, vpn_poolip</searchTemplate>
  <earliestTime>-30d</earliestTime>
  <latestTime>-0d</latestTime>
  <fieldset>
    <input token="SearchHere"/>
  </fieldset>
  <row>
    <html>
    Enter a sourcetype in the field below and this view will pull back the most
    recent 100 events from the metrics log concerning that sourcetype.
    </html>
  </row>
  <row>
    <table>
      <title>activity</title>
      <option name="count">50</option>
      <fields>_raw</fields>
    </table>
  </row>
</form>

riderofyamaha · ‎07-06-2010

thank you very much lowell and nick for your fast responses, ill give this a try and check back here

sideview · ‎07-06-2010

the <fields>_raw</fields> at the end isnt doing anything and should be removed.

Also fyi fields + foo as of 4.0 is deprecated and does the exact same thing as fields foo. There used to be a difference but it's gone now so you might as well use the shorter syntax.

And im not sure why you're getting the inconsistent behaviour but you might try putting this into the <table>:

<fields>host, username, ip, _time, vpn_poolip</fields>

And I think if you have that in there you wont need the fields clause anymore at all in the search.

However what you have should work I think. Its possible the table has maybe started sneaking in its own default and that's inadvertently filtering out the fields you want...

sideview · ‎07-06-2010

Good point. The difference is you are correct, and i am mistaken. 😃 I work here and even I cant keep the vs

Lowell · ‎07-06-2010

What's the different between <fields> and <options name="fields">?

xml problem, can't get right results....

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation