Deployment Architecture

suffic index name to all searches made in the app

manikdham
Path Finder

i want to prefix all searches done in my app with index name. How do i do that.
I use q parameter but that prefixes index name to only the first search. i want to make it a kind of hidden and prefix all searches done in the app with the index name.

Tags (4)
0 Karma
1 Solution

adamw
Communicator

I don't think this is currently possible, although you can populate the search bar with a default value, similar to how the Unix app works.

Basically if you edit $SPLUNK_HOME/etc/apps//default/data/ui/views/.xml, you should find an XML module named "SearchBar", and you can add a new param named "q" with the parameter being whatever you want in the search bar for that view.


true
true
index=os
False

See $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/about_dashboard.xml as an example.

Thanks,
--adam

View solution in original post

0 Karma

adamw
Communicator

I don't think this is currently possible, although you can populate the search bar with a default value, similar to how the Unix app works.

Basically if you edit $SPLUNK_HOME/etc/apps//default/data/ui/views/.xml, you should find an XML module named "SearchBar", and you can add a new param named "q" with the parameter being whatever you want in the search bar for that view.


true
true
index=os
False

See $SPLUNK_HOME/etc/apps/unix/default/data/ui/views/about_dashboard.xml as an example.

Thanks,
--adam

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...