searchlinklister

[splunkpoornima]

Hi all,

please verify the code below ...after running this code ,i got the search query in the search app

as source="c:\tasmanager\taskmanager_log"| Transaction TaskAction startswith=START endswith="Succeeded"

but i want is the query should have the source which has the path name with double slash

source="c:\tasmanager\taskmanager_log"| Transaction TaskAction startswith=START endswith="Succeeded"

             <param name="settingToCreate">list1</param>
                                   <param name="searchFieldsToDisplay">
          <list>
            <param name="label">source</param>
            <param name="value">source</param>
          </list>
          <list>
            <param name="label">totalCount</param>
            <param name="labelFormat">number</param>
          </list>
        </param>

              <module name="HiddenSearch">
                <param name="search"></param>
     <param name="search">
    source="$pub$"| transaction TaskBP startswith=START endswith=Succeeded
                </param>




        <module name="ConvertToIntention">
            <param name="settingToConvert">list1</param>
            <param name="intention">
              <param name="name">stringreplace</param>
              <param name="arg">

            <param name="pub">
              <param name="value">$target$</param> 

                </param>             
              </param>
              </param>

[sowings]

First off, this has nothing to do with SearchLinkLister, so your post title is misleading.

Since you're dealing with Windows paths, you'll want to escape the backslashes in the path elements in order to get the right string. Since that source string is coming from the search which defines the pulldown, you'll have to perform that transformation within that populating search, so that the values are passed correctly.

This answer will help you transform the source field correctly.