Reporting

addterm before the original search terms

mauhumor
Explorer

I am trying to 'reduce' a search scope using addterm :

<module name="HiddenSavedSearch" >
  <param name="savedSearch">Available machines</param>
  <module name="ExtendedFieldSearch">
      <param name="intention">
         <param name="name">addterm</param> 
         <param name="arg"> 
          <param name="clustergroup">
                <param name="default"></param>
            </param> 
         </param> 
         <param name="flags">
         <list>indexed</list>
         </param>
    </param>
</module>
</module>                       

The new 'term' is added to the end of the search 'Avaliable machines', is there a way to added a term to the begining of it, like a search filter ?

Ps: I am avoiding 'replace' and a placeholoder on the saved search because its also used without it.

Tags (1)

sideview
SplunkTrust
SplunkTrust

Actually the indexed should be doing exactly that -- forcing addterm to add to the initial search clause. Strange that it wasnt doing that.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No. You will need to use the stringreplace intention to do this. You may be able to replace the placeholder with an empty string, depending on what input type you are using.

mauhumor
Explorer

That empty string trick did it. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...