Splunk Search

Using Variables in SearchBar

gambusino1984
Engager

Hi, In my view I have a field where I insert a value. I would like to pass this variable into my search using the module "SearchBar". I know how to pass values using "HiddenSearch" module but in my case I would like to use the SearchBar so that was possible to hava something like this in the search:

index="xpto" **A_number=$A-number$** earliest=01/13/2011:10:02:20 latest=01/13/2011:10:03:40 
| timechart count(eval(EVType="OK")) as OK count(eval(EVType="FAILED")) as FAILED  count(eval(EVType="SYSTEMERROR")) as SYSTEMERROR count(eval(EVType="CANCELLED")) as CANCELLED

and this way if the user doesn't insert the value, the variable assume the default "*" and return me the search for all "A_numberes".

Below my "SearchBar" module:

**module name="SearchBar" autoRun="true" submitButton="true" layoutPanel="splSearchControls-inline">
    <param name="useOwnSubmitButton">False</param>
    <param name="useTypeahead">true</param>
    <param name="useAssistant">true</param>
    <param name="label">TIME_DO_SEBEM</param>
    <param name="default">index="xpto" **A_number=$A-number$** earliest=01/13/2011:10:02:20 latest=01/13/2011:10:03:40 | timechart count(eval(EVType="OK")) as OK count(eval(EVType="FAILED")) as FAILED  count(eval(EVType="SYSTEMERROR")) as SYSTEMERROR count(eval(EVType="CANCELLED")) as CANCELLED</param>

Anyway, this search returns me nothing. Is that the correct way to add varibales in the serachbar? How can I set the default value "*"?

Any clue is very welcome.... Thanks in advance.

-Nuno

Tags (1)

dart
Splunk Employee
Splunk Employee

Can you put the HiddenSearch module above the SearchBar, and not specify a default?

0 Karma

cyndiback
Path Finder

Did you ever solve this issue?

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...