Splunk Search

prefix string to search query

manikdham
Path Finder

I am creating an app and want to prefix index= to all searches done in the app.
Is there a way this can be done. The idea is to keep the string either hidden or automatically prefix in the search query.

0 Karma

jonuwz
Influencer

You can do it per view, but not per app (as far as i'm aware)

This will add the equivalent of "NOT source=apache_log" to the beginning of all searches.

<module name="HiddenIntention">
  <param name="intention">
    <param name="name">negateterm</param>
    <param name="arg">
      <param name="source">apache_log</param>
    </param>
    <param name="flags"><list>indexed</list></param>
  </param>

One thing you need to be careful of is users bypassing this by just typeing the query in the url
i.e. https://localhost/en-GB/myapp/search/?q=search source=apache_log.

Putting this above your SumbitButton prevents that :

<module name="Gimp"/>

You can also set a prefix search based on roles : If you go to :

Manager » Access controls » Roles » your_role

There's an option to enter a restiction term applied to all searches.

John

jonuwz
Influencer

You wrap it around any searches you want to be modified by your intention. (Don't forget to close the </module>

Also, HiddenIntention might not be valid as a root module, wrap it in a GenericHeader to test

0 Karma

manikdham
Path Finder

Where do i add this module....when i add this module...my view becomes unavailable...

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...