xml problem, can't get right results....

riderofyamaha · ‎07-06-2010

I'm having a problem with getting simple xml working on a form search that is meant to be used searching for a username or specific ip address. The search should be used to find out certain attributes and group them in a table like pool ip, time, host etc. This should be fairly straight forward but im having problems with the searches not bringing back complete results and sometimes just showing the host and time in the results table. the xml so far is as follows, im sure there is something that im over looking though...

 <form> <label>Search ME</label> <searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net)       

 $SearchHere$ | fields + host, username, ip, _time, vpn_poolip </searchTemplate> <earliestTime>-     
 30d</earliestTime> <latestTime>-0d</latestTime> <html> Enter a sourcetype in the field below 

 and this view will pull back the most recent 100 events from the metrics log concerning that 

 sourcetype. </html> <fieldset> <input token="SearchHere" /> </fieldset> <row> <table> 

 <title>activity</title> <option name="count">50</option> </table> </row> <fields>_raw</fields> 

 </form>



 suggestions?

Lowell · ‎07-06-2010

Seems like there are a couple of tags in the wrong place. Specifically <html> and <fields>, but there could still be other problems. But I think this is a step in the right direction for you:

<?xml version="1.0"?>
<form>
  <label>Search ME</label>
  <searchTemplate>(host=cvpn00bay-inside.bay.cbeyond.net) $SearchHere$ | fields + host, username, ip, _time, vpn_poolip</searchTemplate>
  <earliestTime>-30d</earliestTime>
  <latestTime>-0d</latestTime>
  <fieldset>
    <input token="SearchHere"/>
  </fieldset>
  <row>
    <html>
    Enter a sourcetype in the field below and this view will pull back the most
    recent 100 events from the metrics log concerning that sourcetype.
    </html>
  </row>
  <row>
    <table>
      <title>activity</title>
      <option name="count">50</option>
      <fields>_raw</fields>
    </table>
  </row>
</form>

riderofyamaha · ‎07-06-2010

thank you very much lowell and nick for your fast responses, ill give this a try and check back here

sideview · ‎07-06-2010

the <fields>_raw</fields> at the end isnt doing anything and should be removed.

Also fyi fields + foo as of 4.0 is deprecated and does the exact same thing as fields foo. There used to be a difference but it's gone now so you might as well use the shorter syntax.

And im not sure why you're getting the inconsistent behaviour but you might try putting this into the <table>:

<fields>host, username, ip, _time, vpn_poolip</fields>

And I think if you have that in there you wont need the fields clause anymore at all in the search.

However what you have should work I think. Its possible the table has maybe started sneaking in its own default and that's inadvertently filtering out the fields you want...

sideview · ‎07-06-2010

Good point. The difference is you are correct, and i am mistaken. 😃 I work here and even I cant keep the vs

Lowell · ‎07-06-2010

What's the different between <fields> and <options name="fields">?

xml problem, can't get right results....

Extending Observability Content to Splunk Cloud

More Control Over Your Monitoring Costs with Archived Metrics!

New in Observability Cloud - Explicit Bucket Histograms