Splunk Search

When I am in default search app and click on an index name the query executed has garbage whitespace embedded. How do I fix this?

treyka
Path Finder

I have multiple indexes setup. Most user queries go to my default index however my users typically execute a search on other indexes by going to the search app "home" and clicking the index name in the lower right-hand corner. This populates the search with 'index=[index_name]' however somehow garbage whitespace makes it into the quoted index name. This is really bugging me! This whitespace doesn't appear in any of my config files. Anyone else seeing this behaviour?

Tags (2)
0 Karma
1 Solution

treyka
Path Finder

Ah, yes, I forgot that I had modified my dashboard.xml according to this Splunk blog post: http://blogs.splunk.com/2009/07/29/list-indexes-on-the-main-dashboard/

Since a recent update that hack no longer works. If you want to do that hack substitute the following in place of the xml mentioned in Andrea's blog post.

<module name="HiddenSearch" layoutPanel="panel_row2_col1_grp4" group="All indexed data" autoRun="True">
<param name="search">| eventcount summarize=false index=* -count</param>
<module name="SimpleResultsHeader">                                                                                                                                                                                                      
<param name="entityName">results</param>
<param name="headerFormat">Indexes (%(count)s)</param>
</module>
</module>
<module name="Sorter" layoutPanel="panel_row2_col1_grp4">
<param name="sortKey">count</param>
<param name="sortDir">desc</param>
<param name="fields">
<list>
<param name="label">Index</param>
<param name="value">index</param>
</list>
<list>
<param name="label">Count</param>
<param name="value">count</param>
</list>
</param>
<module name="Paginator" >
<param name="count">10</param>
<param name="entityName">settings</param>
<param name="maxPages">10</param>
<module name="SearchLinkLister">
<param name="settingToCreate">list4</param>
<param name="search">| eventcount summarize=false index=* -count</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">index</param>
<param name="value">index</param>
</list>
<list>
<param name="label">count</param>
<param name="labelFormat">number</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">list4</param>                                                                                                                                                                                             
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="index">$target$</param>
</param>
</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>

View solution in original post

0 Karma

treyka
Path Finder

Ah, yes, I forgot that I had modified my dashboard.xml according to this Splunk blog post: http://blogs.splunk.com/2009/07/29/list-indexes-on-the-main-dashboard/

Since a recent update that hack no longer works. If you want to do that hack substitute the following in place of the xml mentioned in Andrea's blog post.

<module name="HiddenSearch" layoutPanel="panel_row2_col1_grp4" group="All indexed data" autoRun="True">
<param name="search">| eventcount summarize=false index=* -count</param>
<module name="SimpleResultsHeader">                                                                                                                                                                                                      
<param name="entityName">results</param>
<param name="headerFormat">Indexes (%(count)s)</param>
</module>
</module>
<module name="Sorter" layoutPanel="panel_row2_col1_grp4">
<param name="sortKey">count</param>
<param name="sortDir">desc</param>
<param name="fields">
<list>
<param name="label">Index</param>
<param name="value">index</param>
</list>
<list>
<param name="label">Count</param>
<param name="value">count</param>
</list>
</param>
<module name="Paginator" >
<param name="count">10</param>
<param name="entityName">settings</param>
<param name="maxPages">10</param>
<module name="SearchLinkLister">
<param name="settingToCreate">list4</param>
<param name="search">| eventcount summarize=false index=* -count</param>
<param name="searchFieldsToDisplay">
<list>
<param name="label">index</param>
<param name="value">index</param>
</list>
<list>
<param name="label">count</param>
<param name="labelFormat">number</param>
</list>
</param>
<module name="ConvertToIntention">
<param name="settingToConvert">list4</param>                                                                                                                                                                                             
<param name="intention">
<param name="name">addterm</param>
<param name="arg">
<param name="index">$target$</param>
</param>
</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module>
</module>
</module>
</module>
</module>

View solution in original post

0 Karma

DonD3
Engager
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I am not familiar with any list of name of indexes displayed in the default search app. The default app lists source, sourcetype, and host, but not index. Search results may extract and list the index in the field picker in the lower left. Perhaps you have a customized dashboard of some kind?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.