Splunk Search

Substiute head value with static content value

simuvid
Splunk Employee
Splunk Employee

Hi folks,

I have following search param in a HiddenSearch:

      <param name="search">index="overall" src_ip="*" sip_count="*" | chart sum(sip_count) by src_ip | sort - sum(sip_count) | $head$ </param> 

And I have an StaticSelect module:

<module name="StaticSelect" layoutPanel="panel_row1_col1">
  <param name="settingToCreate">head</param>
  <param name="label">Top </param>

  <param name="staticFieldsToDisplay">
    <list>
      <param name="label">10</param>
      <param name="value">head 10</param>
    </list>
    <list>
      <param name="label">20</param>
      <param name="value">head 20</param>
    </list>
    <list>
      <param name="label">50</param>
      <param name="value">head 50</param>
    </list>
    <list>
      <param name="label">100</param>
      <param name="value">head 100</param>
    </list>
  </param>

  <module name="ConvertToIntention">
    <param name="settingToConvert">head</param>
    <param name="intention">
      <param name="name">addterm</param>
      <param name="arg">
        <param name="head">$target$</param>
      </param>
    </param>

After running the HiddenSearch I get following error message:

PARSER: Applying intentions failed Error in 'SearchParser': Missing a search command before '$'.

I am lost and confused. Any help is highly appreciated.

Cheers,

Christian

Tags (1)
0 Karma

hazekamp
Builder

Christian,

From your search you are looking to do a token replacement on $head$. To achieve this you need to use a "stringreplace" intention. You can specify "| head $head$" in your search, or use "prefix" in the intention below.

<module name="ConvertToIntention">
  <param name="settingToConvert">head</param>
  <param name="intention">
    <param name="name">stringreplace</param>
    <param name="arg">
      <param name="head">
        <param name="fillOnEmpty">False</param>
        <param name="prefix">head </param>
        <param name="value">$target$</param>
      </param>
    </param>
  </param>
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...