<% intro = False %>
% if len(error) > 0 :
${error|h}
% elif len(notices) > 0 or len(savedsearches) > 0 or len(autocomplete) > 0 or len(fields) > 0:
<% escprefix = xu.escape(searchprefix).replace('"', '"') %>
% for note in notices:
<%
note = cgi.escape(note)
if "Did you mean" in note:
# Removing links SPL-54537
note = re.sub("'([^']*)'",'
\\1', note)
%>
% if note == "***INTROTXT***":
<% intro = True %>
${_('How to Search')}
${_('Step 1: Retrieve Events')}
${_('The simplest searches return events that match terms you type into the search bar:')}
${_('terms:')} | error login |
${_('quoted phrases:')} | "database error" |
${_('boolean operators:')} | login NOT (error OR fail) |
${_('wildcards:')} | fail* |
${_('field values:')} |
status=404 ,
status!=404 , ${_('or')}
status>200 |
${_('Step 2: Use Search Commands')}
${_('More advanced searches use commands to transform, filter, and report on the events you retrieved.')}
${_('Use the vertical bar')}
"|"
${_(', or pipe character, to apply a command to the retrieved events.')}
% else:
${_('Note:')} ${note}
% endif
% endfor
% if len(savedsearches) > 0:
${_('Note: ')}
${_('Your search looks similar to the savedsearch%s') % ('' if len(savedsearches) <2 else 'es')}
% for i, ss in enumerate(savedsearches):
<% sep = "" %>
<% if i>0: sep = ", " if i
${sep|h}${ss[0]|h}
% endfor
.
% endif
% if len(autonexts) == 0 and len(notices) == 0 and len(fields) > 0 :
% if len(fields) == 1:
${_('Interesting field:')} ${fields[0]|h}.
% else:
${_('Interesting fields:')}
% for i, field in enumerate(fields):
<% replacement = search + ('' if search.endswith('(') else ' ') + field %>
% if i == len(fields)-1:
${field|h}.
% elif len(fields) == 2:
${field|h}
% else:
${field|h},
% endif
% endfor
% endif
% endif
% endif
<% details = command.get('details', '') %>
% if len(command.get('syntax','')) > 0 and not intro:
${command['name']}
|
<% helpurl = generateSelfHelpLink('search_app.assist.%s' % command['name']) %>
${_("Help")}
|${MORE_TEXT}
${_(command['shortdesc'])}
% if len(details):
-
<%doc>TRANS: Command details%doc>${_('Details')}
- ${_(command['details'])}
% endif
-
<%doc>TRANS: Command syntax heading%doc>${_('Syntax')}
|${MORE_TEXT}
- ${command['syntax']}
${_('Syntax')} | ${_('Description')} |
${_('term')} | ${_('variable')} |
${_('term')} | ${_('literal keyword')} |
[] | ${_('optional group')} |
() | ${_('logical group')} |
()+ | ${_('one or more group')} |
()* | ${_('zero or more group')} |
| | ${_('or')} |
% if len(command['related']) > 0:
<%doc>TRANS: Related commands heading%doc>${_('Related')}
- ${command['related']|h}
% endif
% if len(command['aliases']) > 0:
<%doc>TRANS: Commands alias names heading%doc>${_('Aliases')}
- ${command['aliases']|h}
% endif
% if len(command['examples']) > 0:
% for example,comment in command['examples'][:MAX_EXAMPLES_COUNT]:
- ${_(comment)}
- ${example|h}
% endfor
% endif
% endif
% if len(details) == 0 and len(nexts) > 0:
${_('How to Search')}
${_('Using Search Commands')}
${_('More advanced searches use commands to transform, filter, and report on the events you retrieved.')}
- ${_('Use the vertical bar, or pipe character, to apply a command to the retrieved events:')}
sourcetype=access_* error | top 20 uri
- ${_('Further refine or transform your search results with a additional commands: ')}
sourcetype=access_* error | top 20 uri | search count>5
${_('Search assistant will suggest commands for you to use next and show you examples to help you build your search.')}
${_('Other commands')}
% for i, (next, desc, replacement) in enumerate(autonexts):
<% if i < MAX_NEXT_COMMAND_COUNT: continue %>
${next|h}
% endfor
% for next,desc,replacement in nexts:
${next|h}
% endfor
% endif