Splunk Search

Custom search text box

prad18
Path Finder

Hi,

I've created custom text box to search the events in splunk.
my xml :

< module name="HiddenSearch" layoutPanel="panel_row3_col1" group="Search field" autoRun="false">
    < param name="search">host=myhost Fieldname=  *$target$*  < /param>

< module name="ExtendedFieldSearch">

    < param name="intention">
          < param name="name">stringreplace < /param>
     < param name="arg">  
         < param name="target">
           < param name="default">500 < /param>
         < /param>
     < /param>

    < /param>

   < param name="replacementMap">

     < param name="arg">
       < param name="target">
         < param name="value"> < /param>
       < /param>
     < /param>

   < /param>

  < param name="field">Test< /param>

< module name="ResultsHeader" layoutPanel="panel_row3_col1" group="splIcon-events-list" altTitle="Events List">
        < param name="entityLabel">events < /param>
        < param name="entityLabelSingular">event < /param> 
        < param name="entityName">events < /param>

     < module name="Export" layoutPanel="panel_row3_col1">
        < param name="exportType">event < /param> 
     < /module> 

     < module name="EnablePreview" group="show" layoutPanel="panel_row3_col1">
        < param name="enable">True < /param>
     < /module>

     < module name="Paginator" layoutPanel="panel_row3_col1">
        < param name="entityName">events < /param>
        < param name="maxPages">10 < /param>

          < module name="EventsViewer"> 
            < param name="displayRowNumbers">True < /param>
            < param name="enableBehavior">True < /param > 
          < /module>
     < /module>

< /module>

  < /module>

< /module> 

In UI, it has created a text box with label Test in which user will enter input text to serach.

  1. Initially my query was just host=myhost *$target$* target will have user entered input which will be searched in events and it was working fine and even highlighting the input(which user entered in textbox) in the search result. But when i changed the query from host=myhost *$target$* to host=myhost fieldname = *$target$* it worked but stopped highlighting in search results? How to enable highlighting?

  2. How to validate whether user entered any input or just left text box empty? because right now it is searching even if textbox is empty?

I'm new to splunking. Please help me to resolve these and is there any blog or document to understand the xml used in splunk from scratch, I mean each and every < module > used in xml.

0 Karma

linu1988
Champion

Is it a module? Try defining in there

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Concerning highlighting, take a look at the highlight command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/highlight

0 Karma

prad18
Path Finder

Thank you martin.

How can we do validation here?
One more thing is this xml a right one to create search text box ? or should i do it using

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!