make indexer easy accessable

[nebel]

Hi,

people often don't like it to use "index=...". I've tried to make logs easy accessable for them by using macros instead.

For example firewall-logs.

But now people wan't to have a more easier way, without ``. Is there a way to just use a single word for choosing an index in the background? For example just the word "firewall" ?

With tags and eventtypes it is the same. You have to use "tag=...".

Thank you in advance

Regards

[MHibbin]

Create you own flashtimeline and include the indexes as a dropdown...

This would allow to have a free text box for the search string, and then have a dropdown that includes a list of indexes that users can search on.

Perhaps a bit "radical" but hey-ho...

Good starting points:

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/AdvancedSearch

http://docs.splunk.com/Documentation/Splunk/5.0/AdvancedDev/AdvancedSearch

Just an idea, but hope it helps.

[Drainy]

Nope, there is no easier way. I would argue that the `` are pretty easy anyway. Any word entered without these characters would just be interpreted as a search term or command.

Oh, there is the other option of adding it to the indexes their role search by default? It depends on the use case and their roles really. But it is another option if they really are concerned about typing in an additional 2 characters 😉

[Drainy]

err, possibly. This would be moving from the realms of Splunk and more into JavaScript and populating text fields with values based on click events. I still think its a matter of user education. The most common searches and investigations should be in savedsearches or dashboards. You could build custom forms for specific indexes where the index is hidden in the background and users just enter their search terms. You could even add a drop down to the left to select an index first if you really just wanted the one screen.

[nebel]

create a button which adds for a existing search a kind of suffix.

normal search : index= abc
click to button : index = abc OR index = cde

all stuff after index = abc comes from the button.

possible?

[Drainy]

Create a button to search against an index?

[nebel]

thank you! is it possible to create a new button next to the "save" and "create" button which solves this problem? should be not a problem, or?