Splunk Search

Tokens not being resolved by SearchManager

bowesmana
SplunkTrust
SplunkTrust

I am creating a SearchManager

  var detailSearch = new SearchManager({
    id: 'detailSearch',
    earliest_time: '-24h@h',
    latest_time: 'now',
    preview: true,
    cache: false,
    search: '| inputlookup dc_enrichment where _key IN ($parm_add_selection$)' +
          ...
  }, {tokens: true, tokenNamespace: 'submitted'});

and all works fine. However, I am then clearing the search to stop if re-running when the $parm_add_selection$ token changes with

      search.settings.set('search', null);

When I put back the original search with the search.settings.set(), the search does not find the results, because the search does not resolve the token and in the search.log shows it is trying to search for $parm_add_selection$

Does anyone know what the

{tokens: true, tokenNamespace: 'submitted'}

statement does in the initial constructor and if that is relevant to the problem?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Looks like if I wrap the re-setting of the original string in mvc.tokenSafe(), it then works.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...