Error when trying to add token to limit table results in a search?

3618475 — Mon, 08 Jun 2020 18:09:27 GMT

I recreated the dashboard using the report search and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: purchCostReferenceToken

I want to limit the table results based on this token. This is the search:

 <form>
      <label>Thru Train Dashboard</label>
      <fieldset submitButton="false" autoRun="true">
        <input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
          <label>Enter a TMS Reference Number to Filter Table</label>
          <default>*</default>
          <initialValue>*</initialValue>
        </input>
      </fieldset>
      <row>
        <panel>
          <title>Thru Train Data</title>
          <table>
            <search>
              <query>index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments =  mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)"  | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time</query>
              <earliest>-30d@d</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
    </form>

Where do I add the token to limit the search?
I tried adding this to the end of the search before the table command:

 ...   | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) purchCostReference=$purchCostReferenceToken$ | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time

I get an error...error in convert command: the argument purchCostReference- is invalid
I would like to add filters in several of the table columns. The purchCostReference value is an extracted field in the search using xmlkv

Re: Error when trying to add token to limit table results in a search?

richgalloway — Tue, 02 Jun 2020 17:02:14 GMT

If the tokenized fields are automatically extracted then include the tokens in the base search. For example,

index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" purchCostReference=$purchCostReferenceToken$ | xmlkv ...

If the fields aren't automatically extracted then put the tokens after the field extraction.

... | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |search  segment=$purchCostReferenceToken$ | eval Segments = ....

Re: Error when trying to add token to limit table results in a search?

3618475 — Tue, 02 Jun 2020 18:29:40 GMT

Thanks! That worked

Re: Error when trying to add token to limit table results in a search?

3618475 — Tue, 02 Jun 2020 19:55:24 GMT

In my case I just had to add "$purchCostReferenceToken$" to the query

topic Error when trying to add token to limit table results in a search? in Splunk Search

Error when trying to add token to limit table results in a search?

Re: Error when trying to add token to limit table results in a search?

Re: Error when trying to add token to limit table results in a search?

Re: Error when trying to add token to limit table results in a search?