<%! import splunk.util from splunk.appserver.mrsparkle.lib import i18n import re import xml.sax.saxutils as xu from mako.filters import html_escape import splunk.searchhelp.describer as describer import splunk.searchhelp.searchhelper as sh import cgi %> <% # set max number of items to show MAX_NEXT_COMMAND_COUNT = 10 MAX_COMMAND_HISTORY_COUNT = 5 MAX_COMMAND_ARGS = 10 MAX_FIELD_COUNT = 10 MAX_SEARCH_HISTORY_COUNT = 5 MAX_EXAMPLES_COUNT = 3 # set max number of characters to show per item MAX_KEYWORD_LENGTH = 40 MAX_SEARCH_HISTORY_LENGTH = 100 MORE_TEXT = _('More »') LESS_TEXT = _('« Less') %> <%doc> /////////////////////////////////////////////////////////////////////////////// // Left panel container for the typeahead content /////////////////////////////////////////////////////////////////////////////// <% field_output = "" if has_field_args and len(fields)>0: shown = 0 for field in fields: b1, replacement, b2 = sh.getReplacement(search, field) if replacement != '' and len(search) > len(replacement) and not search[-len(replacement)-1].isalnum(): shown += 1 if shown >= MAX_FIELD_COUNT: break if shown == 1: field_output += "

%s

\n" % _('Suggested fields') replacement = search[:-len(replacement)].strip() replacement += ('' if search.endswith('=') or replacement.endswith('(') else ' ') + field replacement = xu.escape(replacement).replace('"', '"') field = xu.escape(field) field_output += '%s\n' % (replacement, field) %> % if len(arg_typeahead)>0 or len(args)>0 or len(autonexts)>0 or len(autocomplete)>0 or (len(typeahead)>0 and typeahead[0][0] != "*") or len(field_output) > 0:
% if len(autocomplete) > 0:

${_('Matching searches')}

% for pastsearch in autocomplete[:MAX_SEARCH_HISTORY_COUNT]: <% displaysearch = describer.escapeAllBut(splunk.util.smartTrim(pastsearch, 60).replace(autocomplete_match, "%s" % autocomplete_match), ["em"]) %> ${displaysearch} % endfor % endif % if len(autonexts) > 0:

${_('Common next commands')}

% for i, (next, desc, replacement) in enumerate(autonexts): <% if i >= MAX_NEXT_COMMAND_COUNT: break %> ${next} % endfor % endif % if (len(typeahead) > 0 and typeahead[0][0] != "*"):

${_('Matching terms')}

% for token, replacement, partial, count in typeahead: % if count > 0: ${i18n.format_number(count) | h} % endif ${splunk.util.smartTrim(token, MAX_KEYWORD_LENGTH).replace(partial, '%s' % partial, 1)} % endfor % endif % if len(args) > 0:

${_('Command history')}

<% shown = 0 %> % for arg,perc in args[:MAX_COMMAND_HISTORY_COUNT]: % try: <% example = "... | %s %s" % (command['name'], arg) %> <% replacement = searchprefix + example[4:] %> ${example|h} % except: % endtry % endfor % endif % if len(arg_typeahead) > 0: <% shown = 0 %> % for arg,val,replacement in arg_typeahead: <% if len(arg) == 0: continue # if we're showing a datatype, replacement just keeps the same search if val == 'choice': replacement = search + arg # if we're showing a datatype, replacement just keeps the same search elif val == 'datatype': replacement = search else: addedEQ = False # handed "showperc":"". change to "showperc=" if val.startswith('<'): #val != '' and arg += '='; replacement += '='; addedEQ = True # if no replacement just append if len(replacement) == 0 or (not addedEQ and replacement == arg) or (addedEQ and len(replacement)==1): # or arg.startswith('<'): replacement = search.strip() + ' ' + arg else: # strip replacement chars and add arg replacement = search[:-len(replacement)].strip() + ' ' + arg %> % if shown == 0:

${_('Command args')}

% endif <% shown += 1 %> <% if shown >= MAX_COMMAND_ARGS: break %> ${arg|h} % endfor % endif % if len(field_output)>0: ${field_output} % endif
% else :
% endif <%doc> /////////////////////////////////////////////////////////////////////////////// // Right panel container for all assist content ///////////////////////////////////////////////////////////////////////////////
<% intro = False %> % if len(error) > 0 :
${error|h}
% elif len(notices) > 0 or len(savedsearches) > 0 or len(autocomplete) > 0 or len(fields) > 0: <% escprefix = xu.escape(searchprefix).replace('"', '"') %> % for note in notices: <% note = cgi.escape(note) autofill='' autofill='' if "Did you mean" in note: if len(re.findall("'([^']*)'", note)) == 1: autofill='class="autocomplete" ' note += _(" Use TAB to autocomplete. ") note = re.sub("'([^']*)'",'\\1', note) %> % if note == "***INTROTXT***": <% intro = True %>

${_('How to Search')}

${_('Step 1: Retrieve Events')} ${_('The simplest searches return events that match terms you type into the search bar:')}
${_('terms:')}error login
${_('quoted phrases:')}"database error"
${_('boolean operators:')}login NOT (error OR fail)
${_('wildcards:')}fail*
${_('field values:')} status=404, status!=404, ${_('or')} status>200
${_('Step 2: Use Search Commands')} ${_('More advanced searches use commands to transform, filter, and report on the events you retrieved.')} ${_('Use the vertical bar')} "|" ${_(', or pipe character, to apply a command to the retrieved events.')}
% else:
${_('Note:')} ${note}
% endif % endfor % if len(savedsearches) > 0:
${_('Note: ')} ${_('Your search looks similar to the savedsearch%s') % ('' if len(savedsearches) <2 else 'es')} % for i, ss in enumerate(savedsearches): <% sep = "" %> <% if i>0: sep = ", " if i ${sep|h}${ss[0]|h} % endfor .
% endif % if len(autonexts) == 0 and len(notices) == 0 and len(fields) > 0 :
% if len(fields) == 1: ${_('Interesting field:')} ${fields[0]|h}. % else: ${_('Interesting fields:')} % for i, field in enumerate(fields): <% replacement = search + ('' if search.endswith('(') else ' ') + field %> % if i == len(fields)-1: ${field|h}. % elif len(fields) == 2: ${field|h} % else: ${field|h}, % endif % endfor % endif
% endif % endif <% details = command.get('details', '') %> % if len(command.get('syntax','')) > 0 and not intro:

${command['name']}

| <% helpurl = generateSelfHelpLink('search_app.assist.%s' % command['name']) %> ${_("Help")} |${MORE_TEXT}
${_(command['shortdesc'])} % if len(command['examples']) > 0:

<%doc>TRANS: Command usage examples heading${_('Examples')}

% for example,comment in command['examples'][:MAX_EXAMPLES_COUNT]:
${_(comment)}
${example|h}
% endfor
% endif
% endif % if len(details) == 0 and len(nexts) > 0:

${_('How to Search')}

${_('Using Search Commands')} ${_('More advanced searches use commands to transform, filter, and report on the events you retrieved.')}
  • ${_('Use the vertical bar, or pipe character, to apply a command to the retrieved events:')}
    sourcetype=access_* error | top 20 uri
  • ${_('Further refine or transform your search results with a additional commands: ')}
    sourcetype=access_* error | top 20 uri | search count>5
${_('Search assistant will suggest commands for you to use next and show you examples to help you build your search.')}

${_('Other commands')}

% for i, (next, desc, replacement) in enumerate(autonexts): <% if i < MAX_NEXT_COMMAND_COUNT: continue %> ${next|h} % endfor % for next,desc,replacement in nexts: ${next|h} % endfor
% endif