Splunk Search

Can you use a searchbar and a hiddensearch?

Path Finder

I am trying to build a view that uses the default searchbar, timeline,fieldpicker, etc but all searches are run against a hidden search.

Requirements:

  1. Recreate look/feel of the flashtimeline view (default searchbar, fieldpicker, etc)
  2. User should not be able to edit/see hidden search
  3. Any information entered in the searchbar should be applied against the hidden search
  4. Ability to use the field picker to enter more search criteria into the search bar

The search works correctly and I have created the view with the Searchbar and hidden search. But information entered in the searchbar does not change the results.



<view autoCancelInterval="100" isPersistable="true" isSticky="true" isVisible="true" objectMode="viewconf" onunloadCancelJobs="false" template="search.html">
<label>Facilities Firewall</label>

<!-- standard splunk chrome at the top -->
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<!-- SearchBar - user types in a search, or comes in on a permalink. The search probably has transforming commands. -->
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useOwnSubmitButton">False</param>
<param name="useTypeahead">true</param>
<param name="useAssistant">true</param>

<module name="TimeRangePicker">
<param name="searchWhenChanged">True</param>
<param name="selected">Last 4 hours</param>

<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>

<module name="HiddenSearch" layoutPanel="mainSearchControls">
<param name="search">index="ndefwsm-dc" NOT static ownersrc="FAC" OR ownerdst="FAC" messagetype=Built OR messagetype=Deny | convert timeformat="%m%d%y" ctime(time) as ctime | eval ownervalidsrc = if(ctime >= datefiltersrc, "Yes", "No") | eval ownervaliddst = if(ctime >= datefilterdst, "Yes", "No") | search ownervalidsrc="Yes" OR ownervaliddst="Yes" | table _time messagetype protocol srcip srcport dstip dstport | rename messagetype AS "Built(Permit) or Deny" protocol AS Protocol srcip AS "Source IP Address(srcip)" srcport AS "Source Port(srcport)" dstip AS "Destination IP Address(dstip)" dstport AS "Destination port(dst_port)"</param>

<module name="Message" layoutPanel="graphArea">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">2</param>

<module name="JobStatus">
<param name="resultsLink">
<param name="popup">True</param>
<param name="viewTarget">reportbuilderdefinedata</param>
<param name="transformedResultsViewTarget">report
builderformatreport</param>
</param>

<module name="FlashTimeline" layoutPanel="graphArea">
<param name="width">100%</param>
<param name="height">95px</param>
<module name="TitleBar" layoutPanel="viewHeader"/>
<module name="FieldPicker" layoutPanel="sidebar">
<param name="fields">host sourcetype source</param>
<param name="link">
<param name="view">reportbuilderformat_report</param>
</param>
<module name="DisableRequiredFieldsButton">
<module name="Message" layoutPanel="resultsAreaLeft">
<param name="filter">pageControls</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
.
.
.

1 Solution

SplunkTrust
SplunkTrust

I think this is only possible with Sideview Utils. Well you could write a bunch of custom javascript to do it but that's no fun. Even if you tried to use a stringreplace intention from one side or the other I don't think it would work without having one or more big ugly $foo$ tokens sitting in the SearchBar that the user would have to never delete.

So go to the page on the Sideview site
( http://sideviewapps.com/apps/sideview-utils/ and then click 'download full version (internal use only'. Once you have the app installed go to the app itself to learn more.

Basically the core UI doesn't offer any way to use the output of the SearchBar module short of letting SearchBar control the entire search. However with Utils you get the Search module to use instead of HiddenSearch. Also Sideview Utils patches the SearchBar module such that it outputs a simple $foo$ token called $searchBar$.

So from your view the way it is,

1) install Sideview Utils
2) Put the SideviewUtils module up at the top out of the way next to the AccountBar (you'll see a note about this on the landing page for the app itself)
3) Replace your HiddenSearch with Search module.
4) You can then use the SearchBar's current text as $searchBar$. You can use it within the Search module, or really within any other sideview module's params.

Of course you get a lot more than just straightforward $foo$ replacement with Sideview Utils, but you can learn more about that later if/when you need other helpful things.

View solution in original post

SplunkTrust
SplunkTrust

I think this is only possible with Sideview Utils. Well you could write a bunch of custom javascript to do it but that's no fun. Even if you tried to use a stringreplace intention from one side or the other I don't think it would work without having one or more big ugly $foo$ tokens sitting in the SearchBar that the user would have to never delete.

So go to the page on the Sideview site
( http://sideviewapps.com/apps/sideview-utils/ and then click 'download full version (internal use only'. Once you have the app installed go to the app itself to learn more.

Basically the core UI doesn't offer any way to use the output of the SearchBar module short of letting SearchBar control the entire search. However with Utils you get the Search module to use instead of HiddenSearch. Also Sideview Utils patches the SearchBar module such that it outputs a simple $foo$ token called $searchBar$.

So from your view the way it is,

1) install Sideview Utils
2) Put the SideviewUtils module up at the top out of the way next to the AccountBar (you'll see a note about this on the landing page for the app itself)
3) Replace your HiddenSearch with Search module.
4) You can then use the SearchBar's current text as $searchBar$. You can use it within the Search module, or really within any other sideview module's params.

Of course you get a lot more than just straightforward $foo$ replacement with Sideview Utils, but you can learn more about that later if/when you need other helpful things.

View solution in original post

Path Finder

Perfect solution! Thank you very much. Can't wait to explore everything else SideviewUtils can help with.

0 Karma