sideviewutils 3.1 - Urlloader foo values for savedsearches result in "foo NOT foo ( the given saved search does not exist )" message.

[Lucas_K]

If I try and use a url passed value as the one that will be used by a dashboard to call a saved search I get the search populated as "foo NOT foo ( the given saved search does not exist )".
I am not running the very latest sideutils on this particular machine. I checked the release notes in between and didn't notice any reference to this.

Line 779 of sideview_utils/appserver/modules/SideviewUtils/SideviewUtils.js

if (!ssWob || !ssWob.hasOwnProperty("search")) return new Splunk.Search("foo NOT foo ( the given saved search does not exist )");

Example dashboard. Which is then called via splunk:8000/en-GB/myapp/sample?searchName=MY_SAVED_SEARCH

<module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
    <module name="HTML" layoutPanel="panel_row1_col2">
      <param name="html">DEBUGGING: Here are the keys that get passed down through the modules from URLLoader:&lt;br&gt;
        searchName: &lt;b&gt;$searchName$&lt;/b&gt;&lt;br&gt;

If I replace the savedsearch parameter name with "MY_SAVED_SEARCH" it will work. Its just the URL populated one that fails, yet the HTML debug shows that it was loaded prior to the savedsearch module.

[sideview · Accepted solution]

The problem is that the SavedSearch module can't pull the savedsearch name from a $foo$ token. So it's literally looking for a savedsearch called "$searchName$".

The reason I haven't gotten to this yet is that it involves a fairly big rewrite of the module. The module currently does all this work when the page is loading, ie before any modules exist, and long before they are passing around $foo$ tokens.

There is a workaround fortunately and that is to use the Search module and get the results for the given job either via the loadjob command or the savedsearch command, depending on whether you're trying to load previously scheduled job, or dispatch a new search.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Loadjob

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/Savedsearch
n