topic Re: How to dispatch a saved search with parameters using the Javascript SDK in Reporting

How to dispatch a saved search with parameters using the Javascript SDK

yoxigen — Mon, 17 Jun 2013 15:23:12 GMT

If I dispatch a saved search with no parameters (like $IP$, $HOST$, $username$, etc), it runs properly and returns result, but for some reason when dispatching a search with parameters, I get no rows in the result.

Here's how I'm sending the search with params:

mySavedSearch.dispatch({ "dispatch.IP": "192.168.0.1" }, function(err, job) { ... }

I got this from the SavedSearch documentation:
http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.1/splunkjs.Service.SavedSearch.html#splunkjs.Service.SavedSearch-dispatch

Can anyone advise me how to run a saved search with the Javascript SDK, with parameters?

Thanks!
Yossi.

Re: How to dispatch a saved search with parameters using the Javascript SDK

Neeraj_Luthra — Tue, 18 Jun 2013 21:51:33 GMT

There are a few dispatch specific arguments you can pass like bucket, max_count, earliest_time etc. You can get the full list at savedsearches.conf.

The parameters that you are trying to use are substituted slightly differently. Here is an example ...

Sample saved search query with host as one of the parameters that I want to substitute at runtime:

index=fooindex sourcetype=foosourcetype host=$args.host$

Sample JS code to dispatch with argument substitution:

mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) {

You can bind multiple parameters in the call above depending on your need. Remember to specify args along with your parameter name as mentioned above.

Re: How to dispatch a saved search with parameters using the Javascript SDK

yoxigen — Wed, 19 Jun 2013 07:21:19 GMT

Thanks Neeraj, this really helps!

In the Javasript SDK documentation it doesn't say anything about having to specify the saved search parameters as "$args.host" instead of "$host", but that's what I was missing.

It'd be great for others looking for the same information if an example was added to the Javascript SDK API reference under SavedSearch.dispatch.

Re: How to dispatch a saved search with parameters using the Javascript SDK

Neeraj_Luthra — Wed, 19 Jun 2013 15:54:03 GMT

Agreed. We have this documented for our Java and C# SDKs but we need to port this information into other SDKs as well.