Refine your search:

alt text

How to put | search splunk_web_service="574.357430" before | rex command in drilldown table?

I mean, after click on value in drilldown table I want search like:

index=test sourcetype="test" splunk_web_service="574.357430" | rex ....

asked 10 Aug '11, 14:05

pero1234's gravatar image

accept rate: 18%

edited 10 Aug '11, 14:08

One Answer:

If you're using the advanced XML, (and I gather from the nature of your quesstion that you're using the 'addterm' intention), then you can add an 'indexed' flag to the intention

Intention syntax is ugly, but here's an addterm intention that adds myField="myValue", and note the last line -- that directive tells the intention system not to try and be clever, but to put the given term in the first search clause always.

<param name="intention">
  <param name="name">addterm</param>
  <param name="arg">
    <param name="myField">myValue</param>
  <param name="flags"><list>indexed</list></param>

answered 10 Aug '11, 22:19

sideview's gravatar image

sideview ♦
accept rate: 48%

edited 10 Aug '11, 22:20

is this possible in sideview utils? without intention?

(16 Aug '13, 07:23) 0waste_splunk

yes it is possible. Lots of things get simpler with Sideview Utils. Pulldown and TextField are far simpler to use compared to SearchSelectLister, StaticSelect, ExtendedFieldSearch and ConvertToIntention, and their arguments are plugged into the search using a simple $foo$ replacement facility on the Sideview Search module. There are a lot of docs and examples in Sideview Utils itself that will walk you through from simple cases.

(16 Aug '13, 09:40) sideview ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions



Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported



Asked: 10 Aug '11, 14:05

Seen: 1,436 times

Last updated: 16 Aug '13, 09:41

Copyright © 2005-2014 Splunk Inc. All rights reserved.