Splunk® Enterprise

Developing Views and Apps for Splunk Web

Download manual as PDF

Download topic as PDF

Build a form search using advanced XML

Important notice: The Advanced XML dashboard framework is officially deprecated. For more information, see Advanced XML Deprecation.

You can add a form search to any view using the advanced XML. Advanced form searches use the ExtendedFieldSearch module in the search view template. To read more about search views, see Introduction to advanced views.

Add chrome

Start out your form search view by adding the chrome:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Sample search</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

Add a form search pattern

All form searches include a form search pattern, which are available from the following modules:

Module Description
HiddenSearch Specifies the base search for your form search. Make sure you specify tokens correctly. For example, $mytoken$
ExtendedFieldSearch Maps the term for replacement from your search. There are several parameters to set with this module.
EventsViewer (or other module to display results) Specify a module to display the results.

The following example is a basic configuration of the ExtendedFieldSearch module. The parent module is a HiddenSearch. The intention and replacementMap parameters each take additional parameters to set up the form input.

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=$st$</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">apache_error</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Sourcetype</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module> <!-- End HiddenSearch -->

Advanced examples

There are many ways to configure a form search using advanced XML. Here are a few examples to get you started.

Use wildcards

This example shows how to use wildcards with a token.

...
  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=apache_error *$target$*</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="target">
                <param name="default">500</param>
            </param>
        </param>
      </param>

      <param name="replacementMap">
        <param name="arg">
          <param name="target">
              <param name="value"></param>
          </param>
        </param>
      </param>

      <param name="field">Wildcard search</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>

    </module> <!-- End ExtendedFieldSearch -->
  </module> <!-- End  HiddenSearch -->

Use two variables

The following example takes two separate tokens as input.

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=apache_error $error$ $hours_ago$</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="error">
                <param name="fillOnEmpty">True</param>
            </param>
        </param>
      </param>

      <param name="replacementMap">
        <param name="arg">
          <param name="error">
              <param name="value"></param>
          </param>
        </param>
      </param>

      <param name="field">Multiple replace (apache search)</param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="hours_ago">
                  <param name="fillOnEmpty">True</param>
                  <param name="prefix">starthoursago=</param>
              </param>
          </param>
        </param>

        <param name="replacementMap">
          <param name="arg">
            <param name="hours_ago">
                <param name="value"></param>
            </param>
          </param>
        </param>

        <param name="field">Multiple replace (starthoursago)</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>

      </module> <!-- End ExtendedFieldSearch -->
    </module> <!-- End ExtendedFieldSearch -->
  </module> <!-- End HiddenSearch -->

Use ORs

The following example shows how to build a search with ORs.

The desired search string is:

eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" OR user="$User$"

You can approximate the search string using the stringreplace parameter to intention's prefix and suffix parameters to intention where $User$ is prefixed with OR user=" and suffixed with ":

eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">
       eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$
    </param>

    <module name="ExtendedFieldSearch">
      <param name="field">SourceIP</param>

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="SourceIP">
                <param name="fillOnEmpty">True</param>
                <param name="value"></param>
            </param> <!-- End SourceIP -->
        </param> <!-- End arg -->
      </param> <!-- end intention -->

      <param name="replacementMap">
        <param name="arg">
          <param name="SourceIP">
              <param name="value"></param>
          </param> <!--End SourceIP -->
        </param> <!--End arg -->
      </param> <!-- replacementMap-->

      <module name="ExtendedFieldSearch">
        <param name="field">User</param>

        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="User">
                  <param name="fillOnEmpty">True</param>
                  <param name="prefix">OR user="</param>
                  <param name="suffix">"</param>
              </param> <!--End User -->
          </param> <!--arg -->
        </param> <!-- end intention -->

        <param name="replacementMap">
          <param name="arg">
            <param name="User">
                <param name="value"></param>
            </param><!--End User -->
          </param> <!--End arg -->
        </param> <!-- replacementMap-->

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module> <!-- End EventsViewer -->

      </module> <!-- End ExtendedFieldSearch -->
    </module> <!-- End ExtendedFieldSearch -->  
  </module> <!-- End HiddenSearch -->

Reuse the same token

This example reuses the same token for two different parts of the search:

...
  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">eventtypetag=config_file source=$File$ OR $File$</param>
    <module name="ExtendedFieldSearch">
      <param name="field">File</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="File">
                <param name="value"></param>
            </param>
        </param>
      </param>
      <param name="replacementMap">
        <param name="arg">
          <param name="File">
              <param name="value"></param>
          </param>
        </param>
      </param>
        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
  </module>
...
PREVIOUS
Build a dashboard using advanced XML
  NEXT
Use XML schemas

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.5.0, 6.5.1, 6.5.1612 (Splunk Cloud only), 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 7.0.0


Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters