Getting Data In
Highlighted

Link to download source files

Path Finder

Hi,

We have a system with many indexed small xml files. Is it possible to have a link/view that displays the full content of all the matches in a search?

Thanks!

Tags (1)
0 Karma
Highlighted

Re: Link to download source files

Path Finder

Hi Oscar,

what you might be able to do is construct a search which produces a link to a page displaying the raw xml for each search result. This could be achieved by using the addinfo command in combination with eval to produce the URL.

Check out this doco, it will give you an idea of how splunk out of the box allows you to view the source for an event. Using that understanding you might be able to achieve what I described above (might, as in I've never tried this myself).

  1. Use addinfo in your search to produce the info_search_id
  2. Construct a URL using eval similar to the following: eval linktoSource="https://URL:8000/en-US/app/APPNAME/show_source?sid=".info_search_id."&offset=0&latest_time="
  3. The result of that eval should be a URL pointing to the raw source of that event. The source for that event should be highlighted.

If this isn't what you're after I hope it gets you on the right track.

Cheers, James

View solution in original post

Highlighted

Re: Link to download source files

Path Finder

Many thanks, it works with just a simple change, instead of infosearchid, you have to use info_sid.

It is a bit weird, as the documentation clearly states what you mention, but infosearchid is not available in my search results...

0 Karma