Link to download source files

[oscargarcia]

Hi,

We have a system with many indexed small xml files. Is it possible to have a link/view that displays the full content of all the matches in a search?

Thanks!

[jamesaarondevli · Accepted solution]

Hi Oscar,

what you might be able to do is construct a search which produces a link to a page displaying the raw xml for each search result. This could be achieved by using the addinfo command in combination with eval to produce the URL.

Check out this doco, it will give you an idea of how splunk out of the box allows you to view the source for an event. Using that understanding you might be able to achieve what I described above (might, as in I've never tried this myself).

1. Use addinfo in your search to produce the info_search_id
2. Construct a URL using eval similar to the following: eval linktoSource="https://URL:8000/en-US/app/APPNAME/show_source?sid=".info_search_id."&offset=0&latest_time="
3. The result of that eval should be a URL pointing to the raw source of that event. The source for that event should be highlighted.

If this isn't what you're after I hope it gets you on the right track.

Cheers, James

[oscargarcia]

Many thanks, it works with just a simple change, instead of info_search_id, you have to use info_sid.

It is a bit weird, as the documentation clearly states what you mention, but info_search_id is not available in my search results...