Splunk Search

Expand XML created variable to search

vagnet
Explorer

Hi Splunkers,

 

Hopefully I am posting on the correct place, apologies if not!

I have the following code/SPL from inside the XML form. It looks inside a lookup, and then gives information about a specific field (field name taken from variable "FieldName") which matches the value of SearchString (value taken from variable "SearchString").

 

| inputlookup $lookup_name$
| search $FieldName$=$SearchString$

 

Those experienced you will see that it doesn't work this way. I am assuming that to make this XML code to work and give me the search result I expect I need to expand the variables?

 

If so, any idea how to do that?

Regards,

vagnet

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Once I created a dummy IPFile.csv lookup and corrected a typo in the form, it worked for me.

<form script="MyScript.js">
  <label>Testing</label>
  <description>For testing of viewing files and their fields</description>
  <fieldset submitButton="false"></fieldset>
 <row>
    <panel>
      <input type="dropdown" token="lookupFile" searchWhenChanged="true">
        <label>lookup</label>
        <fieldForLabel>lookups</fieldForLabel>
        <fieldForValue>lookups</fieldForValue>
        <search>
          <query>| makeresults
| eval lookups="IPFile.csv,MACFile.csv"
| makemv delim="," lookups
| mvexpand lookups
| table lookups</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <input type="dropdown" token="fieldName">
        <label>Select Field to Search</label>
        <fieldForLabel>field</fieldForLabel>
        <fieldForValue>field</fieldForValue>
        <search>
          <query>| inputlookup $lookupFile$
| fieldsummary
| table field</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <default></default>
        <prefix>| search "</prefix>
        <suffix>"</suffix>
        <choice value="">--</choice>
      </input>
      <input type="text" token="searchString" searchWhenChanged="true">
        <label>Free string search</label>
        <default></default>
      </input>
      <table>
        <title>Search in lookup files</title>
        <search>
          <query>| inputlookup $lookupFile$ | search $fieldName$ = "*$searchString$*"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

The fix was to change search FieldName$ = "*$searchString$*" to search $fieldName$ = "*$searchString$*".

richgalloway_0-1634048107541.png

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Input tokens (assuming that's what you mean by "variable") are expanded automatically.

Please describe the problem you are trying to solve.

Please also share the code for the form.

---
If this reply helps you, Karma would be appreciated.

vagnet
Explorer

Thanks for the reply @richgalloway .

Your input was very helpful! However, I still cannot run the search described as described above: "| inputlookup $lookupFile$ | search $fieldName$ = $searchString$ "

 

The whole code is found below:

 <form script="MyScript.js">
  <label>Testing</label>
  <description>For testing of viewing files and their fields</description>
  <fieldset submitButton="false"></fieldset>
 <row>
    <panel>
      <input type="dropdown" token="lookupFile" searchWhenChanged="true">
        <label>lookup</label>
        <fieldForLabel>lookups</fieldForLabel>
        <fieldForValue>lookups</fieldForValue>
        <search>
          <query>| makeresults
| eval lookups="IPFile.csv,MACFile.csv"
| makemv delim="," lookups
| mvexpand lookups
| table lookups</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <input type="dropdown" token="fieldName">
        <label>Select Field to Search</label>
        <fieldForLabel>field</fieldForLabel>
        <fieldForValue>field</fieldForValue>
        <search>
          <query>| inputlookup $lookupFile$
| fieldsummary
| table field</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <default></default>
        <prefix>| search "</prefix>
        <suffix>"</suffix>
        <choice value="">--</choice>
      </input>
      <input type="text" token="searchString" searchWhenChanged="true">
        <label>Free string search</label>
        <default></default>
      </input>
      <table>
        <title>Search in lookup files</title>
        <search>
          <query>| inputlookup $lookupFile$ | search FieldName$ = "*$searchString$*"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  </form>

 

Regards,

vagnet

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Once I created a dummy IPFile.csv lookup and corrected a typo in the form, it worked for me.

<form script="MyScript.js">
  <label>Testing</label>
  <description>For testing of viewing files and their fields</description>
  <fieldset submitButton="false"></fieldset>
 <row>
    <panel>
      <input type="dropdown" token="lookupFile" searchWhenChanged="true">
        <label>lookup</label>
        <fieldForLabel>lookups</fieldForLabel>
        <fieldForValue>lookups</fieldForValue>
        <search>
          <query>| makeresults
| eval lookups="IPFile.csv,MACFile.csv"
| makemv delim="," lookups
| mvexpand lookups
| table lookups</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <input type="dropdown" token="fieldName">
        <label>Select Field to Search</label>
        <fieldForLabel>field</fieldForLabel>
        <fieldForValue>field</fieldForValue>
        <search>
          <query>| inputlookup $lookupFile$
| fieldsummary
| table field</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <default></default>
        <prefix>| search "</prefix>
        <suffix>"</suffix>
        <choice value="">--</choice>
      </input>
      <input type="text" token="searchString" searchWhenChanged="true">
        <label>Free string search</label>
        <default></default>
      </input>
      <table>
        <title>Search in lookup files</title>
        <search>
          <query>| inputlookup $lookupFile$ | search $fieldName$ = "*$searchString$*"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

The fix was to change search FieldName$ = "*$searchString$*" to search $fieldName$ = "*$searchString$*".

richgalloway_0-1634048107541.png

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...