topic Re: Passing a token to a saved report in Dashboards & Visualizations

Passing a token to a saved report

MikeMefford — Wed, 16 Jan 2019 15:45:24 GMT

Is there a way to pass a token from my dashboard (field1) text field that will have a username to a saved report (DSN Test Report)?

`<form>
  <label>DSN Test</label>
  <fieldset submitButton="true">
    <input type="text" token="field1">
      <label>field1</label>
    </input>
    <input type="time" token="field2">
      <label></label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>DSN Test</title>
        <search ref="DSN Test Report">
          <earliest>$field2.earliest$</earliest>
          <latest>$field2.latest$</latest>
          </search>
        <option name="count">50</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

Re: Passing a token to a saved report

MikeMefford — Wed, 16 Jan 2019 16:00:39 GMT

Here is the report and yes I know it will work if I make it a inline search in the dashboard, but you can't set dashboards to run as the "Owner" which is what I need it to do. The report I can set to run as owner.

index=main EventCode=4740 Account_Name=$field1$ 
| eval Account_Name2=mvindex(Account_Name,1), mytime=_time
| convert timeformat="%m-%d-%Y %I:%M:%S %p" ctime(mytime) 
| dedup _time 
| table Account_Name2, Caller_Computer_Name, mytime 
| rename Account_Name2 AS "Account Locked Out", Caller_Computer_Name AS "Lockout Location", mytime AS "Date/Time"
| sort _time

Re: Passing a token to a saved report

kamlesh_vaghela — Thu, 17 Jan 2019 14:05:56 GMT

@MikeMefford

Can you please try savedsearch command?

         <search>
 <query>| savedsearch "DSN Test Report" param1="value1"</query>
           <earliest>$field2.earliest$</earliest>
           <latest>$field2.latest$</latest>
           </search>

Thanks

Re: Passing a token to a saved report

MikeMefford — Thu, 17 Jan 2019 17:53:44 GMT

Thanks for your reply!

So I made the change to my dashboard:

<search>
              <query>| savedsearch "DSN Test Report" Account_Name=$field1$</query>
              <earliest>$field2.earliest$</earliest>
              <latest>$field2.latest$</latest>
              </search>

And also changed the saved search:
index=main EventCode=4740 Account_Name=$field1$

I get the following message when I run it:
Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'DSN Test Report': Error while replacing variable name='field1'. Could not find variable in the argument map.

Re: Passing a token to a saved report

sdchakraborty — Thu, 17 Jan 2019 18:09:14 GMT

your saved search should be like below(same as yours no change)

 index=main EventCode=4740 Account_Name=$field1$ 
 | eval Account_Name2=mvindex(Account_Name,1), mytime=_time
 | convert timeformat="%m-%d-%Y %I:%M:%S %p" ctime(mytime) 
 | dedup _time 
 | table Account_Name2, Caller_Computer_Name, mytime 
 | rename Account_Name2 AS "Account Locked Out", Caller_Computer_Name AS "Lockout Location", mytime AS "Date/Time"
 | sort _time

when you call the saved search in dashboard it should be like below, as field1 is the parameter name of teh saved search

 <search>
               <query>| savedsearch "DSN Test Report" field1="$form.field1$"</query>
               <earliest>$field2.earliest$</earliest>
               <latest>$field2.latest$</latest>
               </search>

Re: Passing a token to a saved report

MikeMefford — Thu, 17 Jan 2019 20:24:41 GMT

Thank you very much! That is what I was wanting, but I'm still having an issue. I'm able to run the dashboard and get results, but my user is unable to get results (No Results). I've set the permissions on the saved search (report) to give their role "Read" access and to run the report as "Owner". Which is the way I have all their other reports set.

Re: Passing a token to a saved report

sdchakraborty — Fri, 18 Jan 2019 08:01:39 GMT

From that user session try to run the saved search query by passing the account name and see whether its returning data. It may not be permission related, it may be query related.

Re: Passing a token to a saved report

MikeMefford — Tue, 29 Sep 2020 22:50:04 GMT

So I had the user run the saved search and they did get results. I did it a couple different ways 1. I totally removed the Account_Name= 2. I hardcoded a username in the Account_Name="???????" and on both they got results. Then I had them try the dashboard with it hard coded and they got "No Results".

Re: Passing a token to a saved report

MikeMefford — Tue, 22 Jan 2019 15:51:28 GMT

sdchakraborty did you have any other ideas on my issue I'm having? I did some testing on your recommendations and posted the results above. Once again thank you for your help on this.

Re: Passing a token to a saved report

sdchakraborty — Wed, 23 Jan 2019 03:12:51 GMT

Sorry I missed the email notification...Can you check whether you are running the search and dashboard from the same app or not? It cloud be permission issue. Also what is the visualization type for that panel? event table or statistical table? for your search it needs to statistical table.

Sid

Re: Passing a token to a saved report

MikeMefford — Wed, 23 Jan 2019 14:09:34 GMT

The report and dashboard are in the same app. Visualization = Statistics Table

Re: Passing a token to a saved report

sdchakraborty — Wed, 23 Jan 2019 14:41:16 GMT

Strange....Can you post the code for that dashboard panel?

Re: Passing a token to a saved report

MikeMefford — Wed, 23 Jan 2019 15:01:14 GMT

Yeah this one has me a little stumped, usually pretty good at finding the issue or code to do what I want.

<form>
  <label>DSN Test</label>
  <fieldset submitButton="true">
    <input type="text" token="account_tok">
      <label>Account Name</label>
    </input>
    <input type="time" token="date_tok">
      <label>Date</label>
      <default>
        <earliest>-14d@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>DSN Test</title>
        <search>
          <query>| savedsearch "DSN Test" account_tok="$form.account_tok$"</query>
          <earliest>$date_tok.earliest$</earliest>
          <latest>$date_tok.latest$</latest>
        </search>
        <option name="count">50</option>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
</form>

Re: Passing a token to a saved report

sdchakraborty — Wed, 23 Jan 2019 15:23:13 GMT

In your saved search definition you have account_tok as parameter name? Or it is field1? Are you calling the savedsearch in same way I mentioned above right?

Re: Passing a token to a saved report

MikeMefford — Wed, 23 Jan 2019 15:29:15 GMT

It's account_tok I cleaned up the previous entries a little bit. Here is the saved search now:

index=main_sec EventCode=4740 Account_Name=$account_tok$
| eval Account_Name2=mvindex(Account_Name,1), mytime=_time
| convert timeformat="%m-%d-%Y %I:%M:%S %p" ctime(mytime) 
| dedup _time 
| table Account_Name2, Caller_Computer_Name, mytime 
| rename Account_Name2 AS "Account Locked Out", Caller_Computer_Name AS "Lockout Location", mytime AS "Date/Time"
| sort _time

Re: Passing a token to a saved report

maartendhondt — Tue, 29 Jan 2019 13:16:54 GMT

@sdchakraborty I'm having the exact same issue.

It seems like a user can only run a savedsearch as the owner with <search ref="test"></search>.

As soon as this is changed to <search><query>| savedsearch "test"</query></search>, the user will always get the No results found. answer back which suggests the savedsearch is ran from the user instead of the owner.

Do you know of a way around that?

Re: Passing a token to a saved report

sdchakraborty — Wed, 30 Jan 2019 05:58:34 GMT

Hi @maartendhondt / @MikeMefford ,

I will do some analysis on this and update you shortly.

Sid

Re: Passing a token to a saved report

sdchakraborty — Wed, 30 Jan 2019 07:00:43 GMT

I just tried and its working for me. I think the issue is happening because of the earliest and latest time you are passing to that search?

  <search>
           <query>| savedsearch "DSN Test" account_tok="$form.account_tok$"</query>
           **<earliest>$date_tok.earliest$</earliest>
           <latest>$date_tok.latest$</latest>**
         </search>

Re: Passing a token to a saved report

maartendhondt — Wed, 30 Jan 2019 07:10:00 GMT

When you got it working, did you restrict your user to not have access to the index? Only the owner should be allowed to search the index. That's the entire reason why I'm using a savedsearch.

Re: Passing a token to a saved report

MikeMefford — Wed, 20 Feb 2019 15:48:13 GMT

Did anyone have any other thoughts on this?