Getting Data In

Link to download source files

oscargarcia
Path Finder

Hi,

We have a system with many indexed small xml files. Is it possible to have a link/view that displays the full content of all the matches in a search?

Thanks!

Tags (1)
0 Karma
1 Solution

jamesaarondevli
Path Finder

Hi Oscar,

what you might be able to do is construct a search which produces a link to a page displaying the raw xml for each search result. This could be achieved by using the addinfo command in combination with eval to produce the URL.

Check out this doco, it will give you an idea of how splunk out of the box allows you to view the source for an event. Using that understanding you might be able to achieve what I described above (might, as in I've never tried this myself).

  1. Use addinfo in your search to produce the info_search_id
  2. Construct a URL using eval similar to the following: eval linktoSource="https://URL:8000/en-US/app/APPNAME/show_source?sid=".info_search_id."&offset=0&latest_time="
  3. The result of that eval should be a URL pointing to the raw source of that event. The source for that event should be highlighted.

If this isn't what you're after I hope it gets you on the right track.

Cheers, James

View solution in original post

jamesaarondevli
Path Finder

Hi Oscar,

what you might be able to do is construct a search which produces a link to a page displaying the raw xml for each search result. This could be achieved by using the addinfo command in combination with eval to produce the URL.

Check out this doco, it will give you an idea of how splunk out of the box allows you to view the source for an event. Using that understanding you might be able to achieve what I described above (might, as in I've never tried this myself).

  1. Use addinfo in your search to produce the info_search_id
  2. Construct a URL using eval similar to the following: eval linktoSource="https://URL:8000/en-US/app/APPNAME/show_source?sid=".info_search_id."&offset=0&latest_time="
  3. The result of that eval should be a URL pointing to the raw source of that event. The source for that event should be highlighted.

If this isn't what you're after I hope it gets you on the right track.

Cheers, James

oscargarcia
Path Finder

Many thanks, it works with just a simple change, instead of info_search_id, you have to use info_sid.

It is a bit weird, as the documentation clearly states what you mention, but info_search_id is not available in my search results...

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...