Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Multiple OR tokens in a simple form not working as expected

$
0
0

I have the following configured form which gives me 4 text boxes. I would like to be able to enter a value for 1 or more of these text boxes to search on.

<searchTemplate>$duser$ OR $suser$ OR $src$ OR $dst$  | head 100 | table _time duser suser src dst</searchTemplate>

  <fieldset>

      <input type="text" token="duser">
        <label>AppleConnect Dest User</label>
        <default></default>
          <prefix>duser=</prefix>
        <suffix>*</suffix>
      </input>

      <input type="text" token="suser">
        <label>AppleConnect Source User</label>
        <default></default>
          <prefix>suser=</prefix>
          <suffix>*</suffix>
      </input>

       <input type="text" token="src">
        <label>Source IP</label>
        <default></default>
           <prefix>src=</prefix>
      </input>

       <input type="text" token="dst">
        <label>Destination IP</label>
        <default></default>
          <prefix>dst=</prefix>
        <suffix></suffix>
      </input>

etc.

If I only enter a value for 1 token, the search does not work as expected. The resulting search looks like this:

"  OR suser=test OR  OR    | head 100  | table _time duser suser src dot "

What am I doing wrong?


Viewing all articles
Browse latest Browse all 13053

Trending Articles