https://community.splunk.com/t5/Dashboards-Visualizations/Unset-token-on-dashboard-page-refresh/m-p/507956#M33775 <P>As a part of my dashboard, I get the results from a base search and join them in a different search in the panel.</P><P>In order to do this, I have created a token for the job id and I load the job in the panel when I am doing a join.</P><P>Base search</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;search id="base_search"&gt; &lt;query&gt; &lt;done&gt; &lt;condition&gt; &lt;set token="base_search"&gt;$job.sid$&lt;/set&gt; &lt;/condition&gt; &lt;/done&gt; &lt;/search&gt;</LI-CODE><P>&nbsp;</P><P>in my panel, I use this base search as a part of the query join</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;query&gt; search sourcetype="ABC" |join type=left [| loadjob $base_search$ ] |stats ... &lt;/query&gt;</LI-CODE><P>&nbsp;</P><P>When the dashboard is refreshed, the token still refers to the old job sid. I would like to know if there is a way to unset the token so that the base query will run again and the token is populated with the current base search result.</P> Wed, 08 Jul 2020 03:05:34 GMT kunwarjit 2020-07-08T03:05:34Z https://community.splunk.com/t5/Dashboards-Visualizations/Unset-token-on-dashboard-page-refresh/m-p/507956#M33775 <P>As a part of my dashboard, I get the results from a base search and join them in a different search in the panel.</P><P>In order to do this, I have created a token for the job id and I load the job in the panel when I am doing a join.</P><P>Base search</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;search id="base_search"&gt; &lt;query&gt; &lt;done&gt; &lt;condition&gt; &lt;set token="base_search"&gt;$job.sid$&lt;/set&gt; &lt;/condition&gt; &lt;/done&gt; &lt;/search&gt;</LI-CODE><P>&nbsp;</P><P>in my panel, I use this base search as a part of the query join</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;query&gt; search sourcetype="ABC" |join type=left [| loadjob $base_search$ ] |stats ... &lt;/query&gt;</LI-CODE><P>&nbsp;</P><P>When the dashboard is refreshed, the token still refers to the old job sid. I would like to know if there is a way to unset the token so that the base query will run again and the token is populated with the current base search result.</P> Wed, 08 Jul 2020 03:05:34 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Unset-token-on-dashboard-page-refresh/m-p/507956#M33775 kunwarjit 2020-07-08T03:05:34Z https://community.splunk.com/t5/Dashboards-Visualizations/Unset-token-on-dashboard-page-refresh/m-p/508302#M33810 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/30476">@kunwarjit</a>&nbsp; by dashboard refresh do you mean using Refresh in the Browser or&nbsp; Refresh option in the dashboard for example&nbsp;<STRONG>refresh="500"</STRONG> or refresh within search?</P> Thu, 09 Jul 2020 13:36:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Unset-token-on-dashboard-page-refresh/m-p/508302#M33810 niketn 2020-07-09T13:36:53Z