topic Re: HiddenSavedSearch not taking a $variable$ in All Apps and Add-ons

HiddenSavedSearch not taking a $variable$

pj — Thu, 01 Mar 2012 16:06:55 GMT

I am creating a dashboard that has a drill down table of values. When the user clicks on the value in the table, the dashboard will send variables to a new dashboard page, which will render the result set.

The new event results dashboard page will read in variables passed to it, which includes the name of the savedsearch I want it to run. The problem I am running into is that HiddenSavedSearch appears to not read a variable?

        <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1">
            <param name="savedSearch">$mySavedSearchVariable$</param>

I know the variable is getting passed into the page, as other splunk elements can read it. Why would HiddenSavedSearch not be able to? If this is an oversight, are there plans to fix or is there a workaround? This search in question can contain up to 50,000 events or more and would be viewed by many different users. The HiddenSavedSearch is nice as it brings the results back almost instantly.

Now of course, I could hard code the name of the search, but the idea was to create an events dashboard that I could feed any HiddenSavedSearch name to.

Thanks!

P.S. - I should add that I am using Sideview Utils. Sounds like the savedsearch module in sideview would give me this functionality, but also sounds like it cant (yet) load last run search results.

This was kind of asked, but then self answered with a (less than ideal) hack in this post:
http://splunk-base.splunk.com/answers/39664/dynamic-saved-search-foo-substitution

Re: HiddenSavedSearch not taking a $variable$

sideview — Fri, 02 Mar 2012 07:02:40 GMT

HiddenSavedSearch is not a Sideview module, but rather a module in the core Splunk UI. Although almost all params in Sideview Utils modules support $foo$ substitution, very few of them in the core Splunk UI do, and I'm afraid the HiddenSavedSearch module's savedSearch param is not one of them.

Sideview Utils has a module called "SavedSearch". Unfortunately as you correctly guessed, that module has never been given the ability to pull jobs previously run by the scheduler, and notably it also does not support $foo$ substitution on it's "savedSearch" param. My apologies on both counts.

As to giving SavedSearch the ability to pull jobs previously run by the scheduler: I'm actually quite surprised I've been able to go this long without anybody emailing me to ask for that. (email me and nag me about it and I'll get it done)

As to the "savedSearch" param not doing $foo$ substitution... Well that's a bit trickier because loading the saved search is generally something that you'd do at page-load time, and not something we can just reload at runtime when an upstream value changes... I'll think about it though and it's certainly not impossible.

Re: HiddenSavedSearch not taking a $variable$

pj — Fri, 02 Mar 2012 19:47:43 GMT

I am passing the page the variable of the saved search from another page before that - so the variable should absolutely be available at page load time. I am then leveraging the sideview URL loader on the new page:

  <module name="URLLoader" layoutPanel="panel_row1_col1" autoRun="True">

I will shoot you a mail. However, in the mean time - am I a little up the creek without a paddle?, or is there some kind of workaround other than using | loadjob in the search module, as the other post suggests that I referred to in my question (which, incidentally is able to take a variable..)

Thanks!

Re: HiddenSavedSearch not taking a $variable$

sideview — Fri, 02 Mar 2012 19:51:15 GMT

A little bit. If it's OK for the substitution to be only at pageload time, directly from the URL, then I can do that. Yes, Search will certainly do $foo$ substitution (Note that Search is a Sideview module, although users are increasingly coming to assume that it's a core module). But no, I cant think of a paddle for you that's any better than loadjob. That's to say I can think of several, but they're all considerably more complicated. In the long run I'll certainly see what I can do.

Re: HiddenSavedSearch not taking a $variable$

royimad — Mon, 25 Feb 2013 13:07:36 GMT

did this issue get resolved on Splunk 5.0 or on new sideview? i have two dashboards created for 2 diffrent host with exactly the same saved searchs used on both of them and i need to consolidate those two dashboards in one single dashboard using the saved search but i need to pass "host" parameter dynamically to this saved search and unable to do that. did you find any workarround for this?

Re: HiddenSavedSearch not taking a $variable$

royimad — Mon, 25 Feb 2013 13:09:24 GMT

I have similar issue and i was wondering how did you fix this ?

Re: HiddenSavedSearch not taking a $variable$

sideview — Mon, 25 Feb 2013 17:31:20 GMT

The SavedSearch module still does not do $foo$ substitution even with latest Sideview Utils. Way back in 2.0 though it did get a useHistory param that can be Auto, False or True.

Re: HiddenSavedSearch not taking a $variable$

Splunkster45 — Fri, 30 Jan 2015 21:23:17 GMT

What's the status on this? I'd love to be able to use $foo$ substitution with HiddenSavedSearches. It's been two years since the last post and so I figured that I'd ask