Documentation > Splunk > Developing Dashboards, Views, and Apps for Splunk Web > Build a form search using Advanced XML

Developing Dashboards, Views, and Apps for Splunk Web

 


Overview
Build dashboards
Build forms
Build advanced views
Customize Splunk Web
Build apps
Build scripted inputs
Extend Splunk
View reference material
Custom charting configuration reference

Build a form search using Advanced XML

Contents

Build a form search using Advanced XML

You can add a form search to any view using the Advanced XML. Advanced form searches use the ExtendedFieldSearch module in the search view template. To read more about search views, see Introduction to advanced views.

Add chrome

Start out your form search view by adding the chrome: 

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Sample search</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

Add a form search pattern

All form searches include a form search pattern, which are available from the following modules:

Module Description
HiddenSearch Specifies the base search for your form search. Make sure you specify tokens correctly. For example, $mytoken$
ExtendedFieldSearch Maps the term for replacement from your search. There are several parameters to set with this module.
EventsViewer (or other module to display results) Specify a module to display the results.

The following example is a basic configuration of the ExtendedFieldSearch module. The parent module is a HiddenSearch. The intention and replacementMap parameters each take additional parameters to set up the form input. 

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=$st$</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">apache_error</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Sourcetype</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module> <!-- End HiddenSearch -->

Advanced examples

There are many ways to configure a form search using Advanced XML. Here are a few examples to get you started.

Use wildcards

This example shows how to use wildcards with a token. 

...
  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=apache_error *$target$*</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="target">
                <param name="default">500</param>
            </param>
        </param>
      </param>

      <param name="replacementMap">
        <param name="arg">
          <param name="target">
              <param name="value"></param>
          </param>
        </param>
      </param>

      <param name="field">Wildcard search</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>

    </module> <!-- End ExtendedFieldSearch -->
  </module> <!-- End  HiddenSearch -->

Use two variables

The following example takes two separate tokens as input. 

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=apache_error $error$ $hours_ago$</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="error">
                <param name="fillOnEmpty">True</param>
            </param>
        </param>
      </param>

      <param name="replacementMap">
        <param name="arg">
          <param name="error">
              <param name="value"></param>
          </param>
        </param>
      </param>

      <param name="field">Multiple replace (apache search)</param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="hours_ago">
                  <param name="fillOnEmpty">True</param>
                  <param name="prefix">starthoursago=</param>
              </param>
          </param>
        </param>

        <param name="replacementMap">
          <param name="arg">
            <param name="hours_ago">
                <param name="value"></param>
            </param>
          </param>
        </param>

        <param name="field">Multiple replace (starthoursago)</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>

      </module> <!-- End ExtendedFieldSearch -->
    </module> <!-- End ExtendedFieldSearch -->
  </module> <!-- End HiddenSearch -->

Use ORs

The following example shows how to build a search with ORs.

The desired search string is: 

eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" OR user="$User$"

You can approximate the search string using the stringreplace parameter to intention intention's prefix and suffix parameters to intention where $User$ is prefixed with OR user=" and suffixed with ":

eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$ 

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">
       eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$
    </param>

    <module name="ExtendedFieldSearch">
      <param name="field">SourceIP</param>

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="SourceIP">
                <param name="fillOnEmpty">True</param>
                <param name="value"></param>
            </param> <!-- End SourceIP -->
        </param> <!-- End arg -->
      </param> <!-- end intention -->

      <param name="replacementMap">
        <param name="arg">
          <param name="SourceIP">
              <param name="value"></param>
          </param> <!--End SourceIP -->
        </param> <!--End arg -->
      </param> <!-- replacementMap-->

      <module name="ExtendedFieldSearch">
        <param name="field">User</param>

        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="User">
                  <param name="fillOnEmpty">True</param>
                  <param name="prefix">OR user="</param>
                  <param name="suffix">"</param>
              </param> <!--End User -->
          </param> <!--arg -->
        </param> <!-- end intention -->

        <param name="replacementMap">
          <param name="arg">
            <param name="User">
                <param name="value"></param>
            </param><!--End User -->
          </param> <!--End arg -->
        </param> <!-- replacementMap-->

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module> <!-- End EventsViewer -->

      </module> <!-- End ExtendedFieldSearch -->
    </module> <!-- End ExtendedFieldSearch -->  
  </module> <!-- End HiddenSearch -->

Reuse the same token

This example reuses the same token for two different parts of the search: 

...
  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">eventtypetag=config_file source=$File$ OR $File$</param>
    <module name="ExtendedFieldSearch">
      <param name="field">File</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="File">
                <param name="value"></param>
            </param>
        </param>
      </param>
      <param name="replacementMap">
        <param name="arg">
          <param name="File">
              <param name="value"></param>
          </param>
        </param>
      </param>
        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
  </module>
...
Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.3.2/Developer/AdvancedFormSearch"

This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!