I have the following configured form which gives me 4 text boxes. I would like to be able to enter a value for 1 or more of these text boxes to search on.
<searchTemplate>$duser$ OR $suser$ OR $src$ OR $dst$ | head 100 | table _time duser suser src dst</searchTemplate>
<fieldset>
<input type="text" token="duser">
<label>AppleConnect Dest User</label>
<default></default>
<prefix>duser=</prefix>
<suffix>*</suffix>
</input>
<input type="text" token="suser">
<label>AppleConnect Source User</label>
<default></default>
<prefix>suser=</prefix>
<suffix>*</suffix>
</input>
<input type="text" token="src">
<label>Source IP</label>
<default></default>
<prefix>src=</prefix>
</input>
<input type="text" token="dst">
<label>Destination IP</label>
<default></default>
<prefix>dst=</prefix>
<suffix></suffix>
</input>
etc.
If I only enter a value for 1 token, the search does not work as expected. The resulting search looks like this:
" OR suser=test OR OR | head 100 | table _time duser suser src dot "
What am I doing wrong?