Splunk Search

prefix string to search query

manikdham
Path Finder

I am creating an app and want to prefix index= to all searches done in the app.
Is there a way this can be done. The idea is to keep the string either hidden or automatically prefix in the search query.

0 Karma

jonuwz
Influencer

You can do it per view, but not per app (as far as i'm aware)

This will add the equivalent of "NOT source=apache_log" to the beginning of all searches.

<module name="HiddenIntention">
  <param name="intention">
    <param name="name">negateterm</param>
    <param name="arg">
      <param name="source">apache_log</param>
    </param>
    <param name="flags"><list>indexed</list></param>
  </param>

One thing you need to be careful of is users bypassing this by just typeing the query in the url
i.e. https://localhost/en-GB/myapp/search/?q=search source=apache_log.

Putting this above your SumbitButton prevents that :

<module name="Gimp"/>

You can also set a prefix search based on roles : If you go to :

Manager » Access controls » Roles » your_role

There's an option to enter a restiction term applied to all searches.

John

jonuwz
Influencer

You wrap it around any searches you want to be modified by your intention. (Don't forget to close the </module>

Also, HiddenIntention might not be valid as a root module, wrap it in a GenericHeader to test

0 Karma

manikdham
Path Finder

Where do i add this module....when i add this module...my view becomes unavailable...

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Mastering Threat Intelligence in ES 8.5, Splunk AI Assistant v2, and More from Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...