Reporting

addterm before the original search terms

mauhumor
Explorer

I am trying to 'reduce' a search scope using addterm :

<module name="HiddenSavedSearch" >
  <param name="savedSearch">Available machines</param>
  <module name="ExtendedFieldSearch">
      <param name="intention">
         <param name="name">addterm</param> 
         <param name="arg"> 
          <param name="clustergroup">
                <param name="default"></param>
            </param> 
         </param> 
         <param name="flags">
         <list>indexed</list>
         </param>
    </param>
</module>
</module>                       

The new 'term' is added to the end of the search 'Avaliable machines', is there a way to added a term to the begining of it, like a search filter ?

Ps: I am avoiding 'replace' and a placeholoder on the saved search because its also used without it.

Tags (1)

sideview
SplunkTrust
SplunkTrust

Actually the indexed should be doing exactly that -- forcing addterm to add to the initial search clause. Strange that it wasnt doing that.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No. You will need to use the stringreplace intention to do this. You may be able to replace the placeholder with an empty string, depending on what input type you are using.

mauhumor
Explorer

That empty string trick did it. Thanks!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...