I would use an HTML module, create a <textarea>
, mark it readonly and dump $search$ into it.
At it's simplest:
<module name="HTML">
<param name="html"><![CDATA[
<textarea readonly>$search$</textarea>
]]></param>
</module>
I would use an HTML module, create a <textarea>
, mark it readonly and dump $search$ into it.
At it's simplest:
<module name="HTML">
<param name="html"><![CDATA[
<textarea readonly>$search$</textarea>
]]></param>
</module>
If you don't want the search to change, I wouldn't display the bar. According to Module Ref, there is no readonly option.
http://docs.splunk.com/Documentation/Splunk/5.0.2/AdvancedDev/ModuleReference#SearchBar