Splunk Search

prefix string to search query

manikdham
Path Finder

I am creating an app and want to prefix index= to all searches done in the app.
Is there a way this can be done. The idea is to keep the string either hidden or automatically prefix in the search query.

0 Karma

jonuwz
Influencer

You can do it per view, but not per app (as far as i'm aware)

This will add the equivalent of "NOT source=apache_log" to the beginning of all searches.

<module name="HiddenIntention">
  <param name="intention">
    <param name="name">negateterm</param>
    <param name="arg">
      <param name="source">apache_log</param>
    </param>
    <param name="flags"><list>indexed</list></param>
  </param>

One thing you need to be careful of is users bypassing this by just typeing the query in the url
i.e. https://localhost/en-GB/myapp/search/?q=search source=apache_log.

Putting this above your SumbitButton prevents that :

<module name="Gimp"/>

You can also set a prefix search based on roles : If you go to :

Manager » Access controls » Roles » your_role

There's an option to enter a restiction term applied to all searches.

John

jonuwz
Influencer

You wrap it around any searches you want to be modified by your intention. (Don't forget to close the </module>

Also, HiddenIntention might not be valid as a root module, wrap it in a GenericHeader to test

0 Karma

manikdham
Path Finder

Where do i add this module....when i add this module...my view becomes unavailable...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...