Splunk Search

Using Variables in SearchBar

gambusino1984
Engager

Hi, In my view I have a field where I insert a value. I would like to pass this variable into my search using the module "SearchBar". I know how to pass values using "HiddenSearch" module but in my case I would like to use the SearchBar so that was possible to hava something like this in the search:

index="xpto" **A_number=$A-number$** earliest=01/13/2011:10:02:20 latest=01/13/2011:10:03:40 
| timechart count(eval(EVType="OK")) as OK count(eval(EVType="FAILED")) as FAILED  count(eval(EVType="SYSTEMERROR")) as SYSTEMERROR count(eval(EVType="CANCELLED")) as CANCELLED

and this way if the user doesn't insert the value, the variable assume the default "*" and return me the search for all "A_numberes".

Below my "SearchBar" module:

**module name="SearchBar" autoRun="true" submitButton="true" layoutPanel="splSearchControls-inline">
    <param name="useOwnSubmitButton">False</param>
    <param name="useTypeahead">true</param>
    <param name="useAssistant">true</param>
    <param name="label">TIME_DO_SEBEM</param>
    <param name="default">index="xpto" **A_number=$A-number$** earliest=01/13/2011:10:02:20 latest=01/13/2011:10:03:40 | timechart count(eval(EVType="OK")) as OK count(eval(EVType="FAILED")) as FAILED  count(eval(EVType="SYSTEMERROR")) as SYSTEMERROR count(eval(EVType="CANCELLED")) as CANCELLED</param>

Anyway, this search returns me nothing. Is that the correct way to add varibales in the serachbar? How can I set the default value "*"?

Any clue is very welcome.... Thanks in advance.

-Nuno

Tags (1)

dart
Splunk Employee
Splunk Employee

Can you put the HiddenSearch module above the SearchBar, and not specify a default?

0 Karma

cyndiback
Path Finder

Did you ever solve this issue?

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...