Splunk Enterprise fill tokens with JavaScript

vini98limasilva — Tue, 07 Sep 2021 12:26:14 GMT

Hello everyone,

I have created a Splunk form which has some html form inputs to update a lookup for me. To get the values from the html form inputs I'm using a Javascript code, such as the one bellow:

require(["splunkjs/mvc", "jquery", "splunkjs/ready!", "splunkjs/mvc/simplexml/ready!" ], function( mvc, $){ var tokens = mvc.Components.get("default"); $('#addentry').on("click", function (e){ var field1 = $("input[name=field1]").val(); tokens.set("tok_add_field1", field1); }) });

Once addentry button is clicked the token is filled by the Javascript and a base search should run to update the value in a lookup. Problem is, after the token which the search needs is filled it still doesn't run (It runs if I go to Edit -> Source -> Cancel).

Search:

<search id="add_results"> <query> | inputlookup example.csv | append [ makeresults | eval field1="$tok_add_field1$"] | outputlookup example.csv </query> <finalized> <set token="confirmation">Search executed!</set> </finalized> </search>

Could someone please tell me what is missing in my search so that it is automatically executed once the tokens are filled? Thanks a lot!

Additionally: I have noticed that once a Splunk input is filled, adding "?" to the URL, javascript will no longer update the tokens. Maybe a problem with the interaction between JS and browser.

topic Splunk Enterprise fill tokens with JavaScript in Dashboards & Visualizations

Splunk Enterprise fill tokens with JavaScript