Implementing Splunk Second Edition by Second Edition

Author:Second Edition [eBook]
Language: eng
Format: mobi, epub
Publisher: Packt Publishing

Stepping through the param instances, we have the following terms and their descriptions:

field: This is the label for the field displayed in the dashboard.

replacementMap: This parameter names the variable that the ExtendedFieldSearch module is creating. I have been told that the nested nature means nothing, and we should simply copy and paste the entire block of XML, changing nothing but the value of the deepest param tag—in this case to user.

intention: Intentions have specific structures that build blocks of query from a structured XML. In the case of stringreplace (which is the most common use case), we can essentially copy the entire XML and, once again, change nothing but the value of the third-level param, which is currently user. The fillOnEmpty value determines whether to make the substitution when the user variable is empty.

All of this code simply tells us to replace $user$ in any searches with the value of the input field. Our first HiddenSearch value looks like the following:<module name="HiddenSearch" ... <param name="search"> sourcetype="impl_splunk_gen" loglevel=error user="$user$" | timechart count as "Error count" by network </param>

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.