Form Creation, Wildcard use

[jsb22]

Essentailly I'm trying to create a form that uses a wildcard by default so users can just hit search on page load and get all values of the field, then the user can input specific values in the field so they can limit what they're seeing. When I specify "< default>*< /default>" it errors out with "Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side". THe fieldset and searchTemplate stream is as follows:

< fieldset>
< input type="text" token="Administrator" />
< default>*< /default>
< /fieldset>

< searchTemplate>(index=windows_7 OR index=windows_2008_R2) source=wineventlog:security EventCode=4720 src_user=$Administrator$ | table _time, src_user, host, dest_nt_domain, signature, user, Display_Name< /searchTemplate>

[MHibbin · Accepted solution]

I may be missing something but I don't know why you have to used \ in your search string..

You can use HTML characters (link here) or you can encase your search in CDATA brackets. However I do not see any of these special characters in your XML.

I have put a working form example in the comment below (for some reason I couldn't get it to appear in answer correctly.. even with "Code Sample" or backticks).

Alos notice I have encased $SRC$ in *'s, this allows for wildcarding on text entered.

Regards,

MHibbin

[MHibbin]

Great News!!

[jsb22]

Turns out it was the escape character, I tested that before, and it didn't work, tested again to try to digest what the CDATA statement does and it worked, must have fat-fingered it somewhere. So my origional code was correct except for the escape character you recommended. Thanks again!

[MHibbin]

Also to add in for others... the CDATA syntax would be

<![CDATA[search_string_here]]>

[MHibbin]

Ha! Ok... I just edited answer... was having some issues getting Splunkbase to allow my XML... kept creating a form input in the answer!!! 😄

[MHibbin]

Simple table (index=main OR index=test) SRC=`*$SRC$*` | stats count by SRC DST -30d -0d

SRC *

20