Can you use a searchbar and a hiddensearch?

[cyndiback]

I am trying to build a view that uses the default searchbar, timeline,fieldpicker, etc but all searches are run against a hidden search.

Requirements:

1. Recreate look/feel of the flashtimeline view (default searchbar, fieldpicker, etc)
2. User should not be able to edit/see hidden search
3. Any information entered in the searchbar should be applied against the hidden search
4. Ability to use the field picker to enter more search criteria into the search bar

The search works correctly and I have created the view with the Searchbar and hidden search. But information entered in the searchbar does not change the results.

<view autoCancelInterval="100" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="false" template="search.html">

<label>Facilities Firewall</label>

<!-- standard splunk chrome at the top -->
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<!-- SearchBar - user types in a search, or comes in on a permalink. The search probably has transforming commands. -->
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useOwnSubmitButton">False</param>
<param name="useTypeahead">true</param>
<param name="useAssistant">true</param>

<module name="TimeRangePicker">
<param name="searchWhenChanged">True</param>
<param name="selected">Last 4 hours</param>

<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>

<module name="HiddenSearch" layoutPanel="mainSearchControls">
<param name="search">index="nde_fwsm-dc" NOT static owner_src="FAC" OR owner_dst="FAC" message_type=Built OR message_type=Deny | convert timeformat="%m%d%y" ctime(_time) as c_time | eval owner_valid_src = if(c_time >= date_filter_src, "Yes", "No") | eval owner_valid_dst = if(c_time >= date_filter_dst, "Yes", "No") | search owner_valid_src="Yes" OR owner_valid_dst="Yes" | table _time message_type protocol src_ip src_port dst_ip dst_port | rename message_type AS "Built(Permit) or Deny" protocol AS Protocol src_ip AS "Source IP Address(src_ip)" src_port AS "Source Port(src_port)" dst_ip AS "Destination IP Address(dst_ip)" dst_port AS "Destination port(dst_port)"</param>

<module name="Message" layoutPanel="graphArea">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">2</param>

<module name="JobStatus">
<param name="resultsLink">
<param name="popup">True</param>
<param name="viewTarget">report_builder_define_data</param>
<param name="transformedResultsViewTarget">report_builder_format_report</param>
</param>

<module name="FlashTimeline" layoutPanel="graphArea">
<param name="width">100%</param>
<param name="height">95px</param>
<module name="TitleBar" layoutPanel="viewHeader"/>
<module name="FieldPicker" layoutPanel="sidebar">
<param name="fields">host sourcetype source</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
<module name="DisableRequiredFieldsButton">
<module name="Message" layoutPanel="resultsAreaLeft">
<param name="filter">pageControls</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
.
.
.

[sideview · Accepted solution]

I think this is only possible with Sideview Utils. Well you could write a bunch of custom javascript to do it but that's no fun. Even if you tried to use a stringreplace intention from one side or the other I don't think it would work without having one or more big ugly $foo$ tokens sitting in the SearchBar that the user would have to never delete.

So go to the page on the Sideview site
( http://sideviewapps.com/apps/sideview-utils/ and then click 'download full version (internal use only'. Once you have the app installed go to the app itself to learn more.

Basically the core UI doesn't offer any way to use the output of the SearchBar module short of letting SearchBar control the entire search. However with Utils you get the Search module to use instead of HiddenSearch. Also Sideview Utils patches the SearchBar module such that it outputs a simple $foo$ token called $searchBar$.

So from your view the way it is,

1) install Sideview Utils
2) Put the SideviewUtils module up at the top out of the way next to the AccountBar (you'll see a note about this on the landing page for the app itself)
3) Replace your HiddenSearch with Search module.
4) You can then use the SearchBar's current text as $searchBar$. You can use it within the Search module, or really within any other sideview module's params.

Of course you get a lot more than just straightforward $foo$ replacement with Sideview Utils, but you can learn more about that later if/when you need other helpful things.

[cyndiback]

Perfect solution! Thank you very much. Can't wait to explore everything else SideviewUtils can help with.