Reporting

addterm before the original search terms

mauhumor
Explorer

I am trying to 'reduce' a search scope using addterm :

<module name="HiddenSavedSearch" >
  <param name="savedSearch">Available machines</param>
  <module name="ExtendedFieldSearch">
      <param name="intention">
         <param name="name">addterm</param> 
         <param name="arg"> 
          <param name="clustergroup">
                <param name="default"></param>
            </param> 
         </param> 
         <param name="flags">
         <list>indexed</list>
         </param>
    </param>
</module>
</module>                       

The new 'term' is added to the end of the search 'Avaliable machines', is there a way to added a term to the begining of it, like a search filter ?

Ps: I am avoiding 'replace' and a placeholoder on the saved search because its also used without it.

Tags (1)

sideview
SplunkTrust
SplunkTrust

Actually the indexed should be doing exactly that -- forcing addterm to add to the initial search clause. Strange that it wasnt doing that.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

No. You will need to use the stringreplace intention to do this. You may be able to replace the placeholder with an empty string, depending on what input type you are using.

mauhumor
Explorer

That empty string trick did it. Thanks!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...