Splunk Search

Custom Search Lite app

Path Finder

I have an odd requirement where I want to limit the index, source or sourcetype for my end users.

I have had a quick go at building my own "Search" app using: http://docs.splunk.com/Documentation/Splunk/6.1.1/AdvancedDev/AdvancedSearch
and advancedxml.

Ideally, I would like it to be SimpleXML, but can live with advancedxml.

The functionality needs to allow me to prepend all searches with some static hidden search (ie index=main | )

Pretty sure I have seen this before and would like to avoid the use of an external framework.

thanks!

0 Karma

Builder

I dont belive it is possible with simple XML.
In splunk 6 using flashtimeline view under;

True

You can add;

 <module name="HiddenIntention">
   <param name="intention">
     <param name="name">addterm</param>
     <param name="arg">
       <param name="index">MyHiddenIndex</param>
     </param>
    </param>

However you are better of trying to use the new webframework and ( i assume, havent really done it yet) creating your own django-template with search terms, like in advanced xml / flashtimeline )

Hope it helps! 🙂

0 Karma

Legend

Is this filtering to be done on a per-user or per-role level? If so you can just create search filters that are automatically applied for each user or role that you specify. This can be set in the access controls section for each user or role in the manager.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!