topic Re: Search event handler not being executed... in Dashboards & Visualizations

Search event handler not being executed...

lyndac — Fri, 20 Oct 2017 18:29:55 GMT

I am using Splunk Enterprise 6.4.7.

Created a dashboard panel. I want to include the number of results in the panel title. I'm trying to use the job.resultCount token in the event handler. I've also tried to use

This is my panel:

<form>
  <row>
    <panel>
      <table>
        <title>$numSrchResults$ Results Returned</title>
        <search>
          <query>index=foo | table _time, name, bar, foobar</query>
          <earliest>$timer_tok.earliest$</earliest>
          <latest>$timer_tok.latest$</latest>
          <done>
              <condition>
                 <eval token="numSrchResults">'job.resultCount'</eval>
              </condition>
          </done>
        </search>
        <option name="rowNumbers">true</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

My search returns about 35 results in the table. However, the token $numSrchResults$ never gets set. I've tried several different things: $job.resultCount$ , 'job.resultCount', using <set></set> instead of <eval></eval>, specifying a match condition, using finalize instead of done. None of these work. Any ideas?

Re: Search event handler not being executed...

gcusello — Sat, 21 Oct 2017 09:05:25 GMT

Hi lyndac,
in my dashboard I always use to put between search tags:

<progress>
     <set token="my_token">$job.resultCount$</set>
</progress>
<cancelled>
     <unset token="my_token"></unset>
</cancelled>

an it runs!

Bye.
Giuseppe

Re: Search event handler not being executed...

kamlesh_vaghela — Tue, 24 Oct 2017 12:41:16 GMT

Hi lyndac,

You can use $job.resultPreviewCount$ for preview count.

Can you please try below XML??

<form>
  <fieldset submitButton="false">
    <input type="time" token="timer_tok">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$numSrchResults$ Results Returned</title>
        <search>
           <query>index=foo | table _time, name, bar, foobar</query>
          <earliest>$timer_tok.earliest$</earliest>
          <latest>$timer_tok.latest$</latest>
          <progress>
              <set token="numSrchResults">$job.resultPreviewCount$</set>
          </progress>
          <cancelled>
              <unset token="numSrchResults"></unset>
          </cancelled>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

Re: Search event handler not being executed...

lyndac — Mon, 30 Oct 2017 18:09:06 GMT

I tried this and still do not get the result count displayed. My code was working when using version 6.4.3, but when we upgraded to 6.4.7, it stopped working. When I look at the generated HTML in the debugger, I do not see a function that would handle the search event. It's like the SimpleXML is not being correctly translated to HTML

Re: Search event handler not being executed...

kamlesh_vaghela — Tue, 31 Oct 2017 02:43:20 GMT

Hi
Can you please share full XML ( hide original search and confidential values) ??

Re: Search event handler not being executed...

lyndac — Tue, 31 Oct 2017 12:22:24 GMT

Full XML is below.

   <form>
      <fieldset submitButton="false">
           <input type="time" token="timer_tok">
              <default>
                  <earliest>@d</earliest>
                  <latest>now</latest>
              </default>
           </input>
       </fieldset>
       <row>
         <panel>
           <table>
             <title>$numSrchResults$ Results Returned</title>
             <search>
               <query>index=foo | table _time, name, bar, foobar</query>
               <earliest>$timer_tok.earliest$</earliest>
               <latest>$timer_tok.latest$</latest>
               <done>
                      <set token="numSrchResults">$job.resultCount$</set>
               </done>
             </search>
             <option name="rowNumbers">true</option>
             <option name="drilldown">none</option>
           </table>
         </panel>
       </row>
     </form>

FWIW -- I converted the dashboard to HTML and added code to handle the done event, and that works. However, I should NOT have to convert to HTML just for that work. This is the code that I had to add:

search1.on("search:done", function(properties) {
setToken("numresults", properties.content.resultCount);
});

Re: Search event handler not being executed...

niketn — Tue, 31 Oct 2017 12:45:13 GMT

@lyndac the search event handlers to access job tokens and results tokens were changed to<progress> and <done> from Splunk Enterprise 6.5 onward. Till version 6.4 they were <preview> and <finalized>. Try your dashboard with <finalized> instead of <done> and hopefully it should work. http://docs.splunk.com/Documentation/Splunk/6.4.7/Viz/EventHandlerReference#finalized

 <finalized>
     <set token="numSrchResults">$job.resultCount$</set>
 </finalized>

Please try out and confirm.

PS: <preview> and <finalized> have been removed since 6.5. So, you will have to reconsider moving back to <progress> or <done> when you plan your next upgrade.

Re: Search event handler not being executed...

lyndac — Tue, 31 Oct 2017 13:17:53 GMT

I've tried , , even
I've tried using $job.resultCount$ and 'job.resultCount'
None are working.

Re: Search event handler not being executed...

niketn — Tue, 31 Oct 2017 17:32:36 GMT

Or just to test whether our event handlers are being invoked... It should hit one of the conditions either default to 0 or show some value (may be null in your case if it does not work 😞 )

  <finalized>
      <condition match="$job.resultCount$==0">
           <set token="numSrchResults">0</set>
      </condition>
      <condition>
           <set token="numSrchResults">$job.resultCount$</set>
      </condition>
  </finalized>

Try something similar with <preview> instead of <finalized>
So many hit and trials would be frustrating so it is better you open up a support case with Splunk to have them look at the issues you are facing. Ideally this should have worked.

Re: Search event handler not being executed...

kamlesh_vaghela — Sat, 04 Nov 2017 17:14:14 GMT

Hi
Does it work for you?