Splunk Search

Custom search text box

prad18
Path Finder

Hi,

I've created custom text box to search the events in splunk.
my xml :

< module name="HiddenSearch" layoutPanel="panel_row3_col1" group="Search field" autoRun="false">
    < param name="search">host=myhost Fieldname=  *$target$*  < /param>

< module name="ExtendedFieldSearch">

    < param name="intention">
          < param name="name">stringreplace < /param>
     < param name="arg">  
         < param name="target">
           < param name="default">500 < /param>
         < /param>
     < /param>

    < /param>

   < param name="replacementMap">

     < param name="arg">
       < param name="target">
         < param name="value"> < /param>
       < /param>
     < /param>

   < /param>

  < param name="field">Test< /param>

< module name="ResultsHeader" layoutPanel="panel_row3_col1" group="splIcon-events-list" altTitle="Events List">
        < param name="entityLabel">events < /param>
        < param name="entityLabelSingular">event < /param> 
        < param name="entityName">events < /param>

     < module name="Export" layoutPanel="panel_row3_col1">
        < param name="exportType">event < /param> 
     < /module> 

     < module name="EnablePreview" group="show" layoutPanel="panel_row3_col1">
        < param name="enable">True < /param>
     < /module>

     < module name="Paginator" layoutPanel="panel_row3_col1">
        < param name="entityName">events < /param>
        < param name="maxPages">10 < /param>

          < module name="EventsViewer"> 
            < param name="displayRowNumbers">True < /param>
            < param name="enableBehavior">True < /param > 
          < /module>
     < /module>

< /module>

  < /module>

< /module> 

In UI, it has created a text box with label Test in which user will enter input text to serach.

  1. Initially my query was just host=myhost *$target$* target will have user entered input which will be searched in events and it was working fine and even highlighting the input(which user entered in textbox) in the search result. But when i changed the query from host=myhost *$target$* to host=myhost fieldname = *$target$* it worked but stopped highlighting in search results? How to enable highlighting?

  2. How to validate whether user entered any input or just left text box empty? because right now it is searching even if textbox is empty?

I'm new to splunking. Please help me to resolve these and is there any blog or document to understand the xml used in splunk from scratch, I mean each and every < module > used in xml.

0 Karma

linu1988
Champion

Is it a module? Try defining in there

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning highlighting, take a look at the highlight command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/highlight

0 Karma

prad18
Path Finder

Thank you martin.

How can we do validation here?
One more thing is this xml a right one to create search text box ? or should i do it using

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...