addterm

This intention is useful to add search terms to a query with or without user interaction. For example, let's say you always want to ensure that a particular value of the field source is queried. You can then modify the query that will be run, appending a search term. Here is an example from the advanced_lister_with_ dashboard.

The searchbar in the UI examples app is available at http://splunkbase.com. The following code encapsulates this discussion:

<module name="HiddenIntention"> <param name="intention"> <param name="name">addterm</param> <param name="arg"> <param name="source">*metrics.log</param> </param> <!-- tells the addterm intention to put our term in the first search clause no matter what. --> <param name="flags"><list>indexed</list></param> ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.