Build a form search using advanced XML

Important notice: The Advanced XML dashboard framework is officially deprecated. For more information, see Advanced XML Deprecation.

You can add a form search to any view using the advanced XML. Advanced form searches use the ExtendedFieldSearch module in the search view template. To read more about search views, see Introduction to advanced views.

Add chrome

Start out your form search view by adding the chrome:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Sample search</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

Add a form search pattern

All form searches include a form search pattern, which are available from the following modules:

Module	Description
HiddenSearch	Specifies the base search for your form search. Make sure you specify tokens correctly. For example, $mytoken$
ExtendedFieldSearch	Maps the term for replacement from your search. There are several parameters to set with this module.
EventsViewer (or other module to display results)	Specify a module to display the results.

The following example is a basic configuration of the ExtendedFieldSearch module. The parent module is a HiddenSearch. The intention and replacementMap parameters each take additional parameters to set up the form input.

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=$st$</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="st">
                <param name="default">apache_error</param>
            </param>
        </param>
      </param> <!-- End param intention-->

      <param name="replacementMap">
        <param name="arg">
          <param name="st">
              <param name="value"></param>
          </param>
        </param>
      </param> <!-- End param replacementMap -->

      <param name="field">Sourcetype</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>
    </module> <!-- End ExtendedFieldSearch-->
  </module> <!-- End HiddenSearch -->

Advanced examples

There are many ways to configure a form search using advanced XML. Here are a few examples to get you started.

Use wildcards

This example shows how to use wildcards with a token.

...
  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=apache_error *$target$*</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="target">
                <param name="default">500</param>
            </param>
        </param>
      </param>

      <param name="replacementMap">
        <param name="arg">
          <param name="target">
              <param name="value"></param>
          </param>
        </param>
      </param>

      <param name="field">Wildcard search</param>

      <module name="EventsViewer" layoutPanel="resultsAreaLeft">
        <param name="segmentation">full</param>
      </module>

    </module> <!-- End ExtendedFieldSearch -->
  </module> <!-- End  HiddenSearch -->

Use two variables

The following example takes two separate tokens as input.

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">sourcetype=apache_error $error$ $hours_ago$</param>

    <module name="ExtendedFieldSearch">
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="error">
                <param name="fillOnEmpty">True</param>
            </param>
        </param>
      </param>

      <param name="replacementMap">
        <param name="arg">
          <param name="error">
              <param name="value"></param>
          </param>
        </param>
      </param>

      <param name="field">Multiple replace (apache search)</param>

      <module name="ExtendedFieldSearch">
        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="hours_ago">
                  <param name="fillOnEmpty">True</param>
                  <param name="prefix">starthoursago=</param>
              </param>
          </param>
        </param>

        <param name="replacementMap">
          <param name="arg">
            <param name="hours_ago">
                <param name="value"></param>
            </param>
          </param>
        </param>

        <param name="field">Multiple replace (starthoursago)</param>

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>

      </module> <!-- End ExtendedFieldSearch -->
    </module> <!-- End ExtendedFieldSearch -->
  </module> <!-- End HiddenSearch -->

Use ORs

The following example shows how to build a search with ORs.

The desired search string is:

eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" OR user="$User$"

You can approximate the search string using the stringreplace parameter to intention's prefix and suffix parameters to intention where $User$ is prefixed with OR user=" and suffixed with ":

eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$

  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">
       eventtypetag=authentication tag=cardholder-dest src_ip="$SourceIP$" $User$
    </param>

    <module name="ExtendedFieldSearch">
      <param name="field">SourceIP</param>

      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="SourceIP">
                <param name="fillOnEmpty">True</param>
                <param name="value"></param>
            </param> <!-- End SourceIP -->
        </param> <!-- End arg -->
      </param> <!-- end intention -->

      <param name="replacementMap">
        <param name="arg">
          <param name="SourceIP">
              <param name="value"></param>
          </param> <!--End SourceIP -->
        </param> <!--End arg -->
      </param> <!-- replacementMap-->

      <module name="ExtendedFieldSearch">
        <param name="field">User</param>

        <param name="intention">
          <param name="name">stringreplace</param>
          <param name="arg">
              <param name="User">
                  <param name="fillOnEmpty">True</param>
                  <param name="prefix">OR user="</param>
                  <param name="suffix">"</param>
              </param> <!--End User -->
          </param> <!--arg -->
        </param> <!-- end intention -->

        <param name="replacementMap">
          <param name="arg">
            <param name="User">
                <param name="value"></param>
            </param><!--End User -->
          </param> <!--End arg -->
        </param> <!-- replacementMap-->

        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module> <!-- End EventsViewer -->

      </module> <!-- End ExtendedFieldSearch -->
    </module> <!-- End ExtendedFieldSearch -->  
  </module> <!-- End HiddenSearch -->

Reuse the same token

This example reuses the same token for two different parts of the search:

...
  <module name="HiddenSearch" layoutPanel="mainSearchControls">
    <param name="search">eventtypetag=config_file source=$File$ OR $File$</param>
    <module name="ExtendedFieldSearch">
      <param name="field">File</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
            <param name="File">
                <param name="value"></param>
            </param>
        </param>
      </param>
      <param name="replacementMap">
        <param name="arg">
          <param name="File">
              <param name="value"></param>
          </param>
        </param>
      </param>
        <module name="EventsViewer" layoutPanel="resultsAreaLeft">
          <param name="segmentation">full</param>
        </module>
      </module>
  </module>
...