topic Re: How to store 1st search result in a token/variable and plug in token in other searches? (instead of running macro for each search) in Dashboards & Visualizations

How to store 1st search result in a token/variable and plug in token in other searches? (instead of running macro for each search)

kkas — Wed, 01 Jul 2015 16:56:00 GMT

I am making a dashboard that takes in a network ID and outputs information about that user.

Many of the searches require finding the main IP address of the user. I have a macro to output the IP from an inputted Network ID.
The problem is the macro can take some time to finish, so it adds on to the speed of finding search results. And if you compound that onto a lot of panels (10+) finding all results can be slowed heavily, especially since I'm looking to add more panels.

Is there a way to just do the macro once and set the result to a token/variable and just plug that variable into the panel searches rather than plugging in the macro and running the macro for each search?

User inputs network ID -> macro runs on that net ID and stores IP in a variable -> plug in variable in different searches

Re: How to store 1st search result in a token/variable and plug in token in other searches? (instead of running macro for each search)

lguinn2 — Fri, 03 Jul 2015 21:18:32 GMT

I think a better solution may be to use "post-process searches" in your dashboard. Generally, the panels in a dashboard display various views of a common set of data. Figure out the base search that can drive all (or most) of the panels - which should include the macro - and then post-process the base search results for each panel.

This may give you even more efficiency than you expected!

Here is a link to the docs on Post-process searches. You can also search for "Splunk postprocess search dashboard" and you will find a number of links to questions on Answers as well.

Re: How to store 1st search result in a token/variable and plug in token in other searches? (instead of running macro for each search)

kkas — Fri, 10 Jul 2015 14:18:22 GMT

Ok I came back because I found a funny way to do what I was looking for a little better.
I was able to use the dropdown and multisearching tool to store results. I used the autopopulate tool that allows you to input a search and populate the dropdown variables with the search results. You can then use that multisearch/dropdown's token anywhere in the code unlike post processing where it requires the search to be front end based.
The multiselect tool was coded as follows for future reference

<input type="multiselect" searchWhenChanged="true" token="comp">
      <label>Select ComputerName's to Assess</label>
      <default>All</default>
      <search>
        <query>sourcetype="Alpha" Account_Name=$netID$ earliest=$field1.earliest$ latest=$field1.latest$|stats count(ComputerName) by ComputerName</query>
      </search>
      <choice value="*">All</choice>
      <valuePrefix>ComputerName=</valuePrefix>
      <delimiter> OR </delimiter>
      <fieldForLabel>ComputerName</fieldForLabel>
      <fieldForValue>ComputerName</fieldForValue>
    </input>

Re: How to store 1st search result in a token/variable and plug in token in other searches? (instead of running macro for each search)

arorajagmeet — Wed, 18 May 2016 13:55:27 GMT

Very nice solution kkas. Simple and non-intrusive.

Re: How to store 1st search result in a token/variable and plug in token in other searches? (instead of running macro for each search)

daishih — Wed, 10 Aug 2016 16:05:36 GMT

I tried to duplicate this but the multi select search never finishes for me it just spins 😞 I ran the search in the main splunk search and it returns results just fine. Help?