Security

searchbnf configuration always puts an 'equal' after the suggestions

jschoenberg_spl
Splunk Employee
Splunk Employee

In Splunk I have configured the searchbnf.conf to provide some helpful search hints inline while the person types SPL. It works pretty good, with each search option coming up in green as a suggestion. However, the suggestions always have an equal sign after the option is found. For instance, the custom search I created is runmycmd, and it has the option of trigger, then a host= parameter for the user to use in SPL. The right way to use it is like this | runmycmd trigger host=mylinuxmachine.

In my searchbnf.conf I am specifying that trigger is an option top the runmycmd command, but it always wants to put an equal sign. Is there a different option here that restricts the help to just a parameter name rather than a name=value pair?

[runmycmd-command]
syntax = runmycmd | |
shortdesc = Executes a request of your environment to bring data in. This command includes several operators.
description = Uses this method to retrieve data
usage = public
example1 = | runmycmd trigger host=mylinuxmachine
comment1 = In this example if you find a trigger that is on a host named mylinuxmachine

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...