topic Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML? in Splunk Search

Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

helenashton — Thu, 08 Jan 2015 22:30:00 GMT

I want to be able to use my search for a few things, i.e. a table then further search or html display based on certain values in the first row of results.

In advanced XML and Sideview I used to be able to get information from the first row of a search's results by using $results[0].fieldname$.

Can I do something similar in simple xml?

Thanks!

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

dfoster_splunk — Thu, 08 Jan 2015 22:50:26 GMT

To my knowledge there aren't any tokens in Simple XML that are auto-populated by running searches.

You could create a SearchManager in JS and grab the results from that directly.

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

helenashton — Thu, 08 Jan 2015 22:51:56 GMT

Can't do that unfortunately as I don't have permission to upload js files - if I could include js in the dashboard I'd be good... but I can't seem to.

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

dfoster_splunk — Mon, 28 Sep 2020 18:36:44 GMT

Yeah there's no way to inline JS in Simple XML. It has to be included via [form script="foo_in_appserver_static.js].

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

martin_mueller — Thu, 08 Jan 2015 23:29:37 GMT

Technically you could include inline JS in HTML dashboards converted from SimpleXML. Good to start development, bad for maintenance and larger-scale deployment later.

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

helenashton — Fri, 09 Jan 2015 15:21:27 GMT

Yup, which is why I don't want to do it that way.
It really would be helpful (for maintenance) to have inline JavaScript - anyone know if it's on the plan?

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

dfoster_splunk — Fri, 09 Jan 2015 18:38:09 GMT

[script] tags are explicitly stripped out of [html] blocks in Simple XML, which leads me to believe that inline JS is explicitly not on the plan due to security issues. If a regular visitor could edit a dashboard and insert [script] tags in an [html] block, you could potentially have cookie-stealing code and other issues.

Anyone on the Simple XML team with a more authoritative answer?

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

helenashton — Fri, 09 Jan 2015 18:46:13 GMT

I think it should be our choice (as developers of a dashboard) if we are prepared to accept any risks. It opens up SO many options of things we can do to improve our dashboards. We have been doing this a lot in advanced XML, but if the trend is towards simple XML, then this feature is really important to allow us to make our dashboards usable and maintainable.

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

jdonn_splunk — Fri, 11 Mar 2016 17:32:58 GMT

I have had the need to do this myself a few times, and I just figured it out. What you want to do is create a token that you can reference in HTML. To do this dynamically, we can use a form input. The important parts here are:

Use a dropdown input.
Create a search that gives you the result that you want to tokenize.
Hide the input by assigning a dummy depends token in the input type.

Set the * selectFirstChoice* parameter to true.

  <input type="dropdown" token="last_update" searchWhenChanged="true" depends="$justHideMe$">
    <label>last_update</label>
    <search>
      <query>index=my_data_updates | head 1 | convert timeformat="%H:%M:%S on %m/%d/%Y" ctime(_time) AS last_update | table last_update</query>
    </search>
    <fieldForLabel>last_update</fieldForLabel>
    <fieldForValue>last_update</fieldForValue>
    <selectFirstChoice>true</selectFirstChoice>
  </input>

You can now reference $last_update$ in your HTML panels.

Check out my example "last updated" dashboard at the bottom of this App:

https://splunkbase.splunk.com/app/2919/

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

sloshburch — Fri, 11 Mar 2016 19:20:05 GMT

To @jdonn's point, this functionality is now available in the newer versions of Splunk.

Here's some docs to elaborate:

New tokens for search job related status: http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/tokens#Define_search_tokens
Get specific values from specific items in the result set: http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/tokens#Define_tokens_for_dynamic_drilldown and http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/Understandbasictableandchartdrilldownactions#Drilldown_event_tokens
Set and unset variables from search results: http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/Understandbasictableandchartdrilldownactions#Dynamic_drilldown_elements

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

bcronrath — Tue, 15 Nov 2016 00:06:32 GMT

In case anyone wants an example, here is one that I just did:

<search id="minVal">
           <query>| makeresults | eval minute_val=`cts_sm_minute_builder`</query>
           <earliest>$t_picker.earliest$</earliest>
    <latest>$t_picker.latest$</latest>
           <finalized>
            <set token="minute_val">$result.minute_val$</set>>
           </finalized>
         </search>

where that macro is basically giving me back some calculated values based on the time picker entries

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

niketn — Tue, 15 Nov 2016 06:01:48 GMT

Even in Splunk Simple XML $result.[fieldname]$ is available provided applicable only for the first row. Please check the Search Event Handlers:
1) http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference
2) http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens

You can also check out the Splunk 6.x Dashboard Examples App for Search Result Setter example which calls out various search tokens.

Please let me know if you need example for $result.[fieldname]$ token.

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

feickertmd — Tue, 29 Sep 2020 13:16:00 GMT

Here's an easy way!!
see for reference: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Search_event_elements_and_job_properties

You need to set the token in the section and call the result there. Here's a sample:

<panel>
      <title>Maximum API calls in one hour over last 7 days</title>
      <single>
        <title>Max hits for api: $max_api$</title>
        <search>
          <query>...</query>
          ...
          <done>
            <set token="max_api">$result.api$</set>
          </done>
        </search>

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

feickertmd — Fri, 17 Mar 2017 18:03:35 GMT

see my answer below