Reporting

addterm before the original search terms

mauhumor
Explorer

I am trying to 'reduce' a search scope using addterm :

<module name="HiddenSavedSearch" >
  <param name="savedSearch">Available machines</param>
  <module name="ExtendedFieldSearch">
      <param name="intention">
         <param name="name">addterm</param> 
         <param name="arg"> 
          <param name="clustergroup">
                <param name="default"></param>
            </param> 
         </param> 
         <param name="flags">
         <list>indexed</list>
         </param>
    </param>
</module>
</module>                       

The new 'term' is added to the end of the search 'Avaliable machines', is there a way to added a term to the begining of it, like a search filter ?

Ps: I am avoiding 'replace' and a placeholoder on the saved search because its also used without it.

Tags (1)

sideview
SplunkTrust
SplunkTrust

Actually the indexed should be doing exactly that -- forcing addterm to add to the initial search clause. Strange that it wasnt doing that.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No. You will need to use the stringreplace intention to do this. You may be able to replace the placeholder with an empty string, depending on what input type you are using.

mauhumor
Explorer

That empty string trick did it. Thanks!

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...