All Apps and Add-ons

Multiple OR tokens in a simple form not working as expected

the_wolverine
Champion

I have the following configured form which gives me 4 text boxes. I would like to be able to enter a value for 1 or more of these text boxes to search on.

 <searchTemplate>$duser$ OR $suser$ OR $src$ OR $dst$  | head 100 | table _time duser suser src dst</searchTemplate>

  <fieldset>

      <input type="text" token="duser">
        <label>AppleConnect Dest User</label>
        <default></default>
          <prefix>duser=</prefix>
        <suffix>*</suffix>
      </input>

      <input type="text" token="suser">
        <label>AppleConnect Source User</label>
        <default></default>
          <prefix>suser=</prefix>
          <suffix>*</suffix>
      </input>

       <input type="text" token="src">
        <label>Source IP</label>
        <default></default>
           <prefix>src=</prefix>
      </input>

       <input type="text" token="dst">
        <label>Destination IP</label>
        <default></default>
          <prefix>dst=</prefix>
        <suffix></suffix>
      </input>

etc.

If I only enter a value for 1 token, the search does not work as expected. The resulting search looks like this:

"  OR suser=test OR  OR    | head 100  | table _time duser suser src dot "

What am I doing wrong?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I don't have a Splunk available to test, but here's a generic thought: Prefix your search with a term that is never true (e.g. foo=bar), and include the OR in each input's prefix.

If you enter nothing in any field you should get this:

foo=bar | ...

If you fill one field you should get this:

foo=bar OR suser=something | ...

If you fill more than one field you just add more " OR field=value" to that, maintaining syntactic correctness.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...