Dashboards & Visualizations

Display full SPL from job properties for a post-process search


When debugging a dashboard sometimes it's helpful to be able to see the search that was ran with all the token values.  To do this, I sometimes add inline HTML to show me the query strings so that I don't have to keep opening a new window to view what it is that broke the search.  However, this worked fine until I started debugging post-process searches.  Here's an example:


<input type=dropdown token="filterZ">
<search id="base">
  <query>index=abc | stats count by fieldA, fieldB</query>

<search base="base">
  <query>| search fieldA="$filterZ$"</query>
      <eval token="resCount">$job.resultCount$</eval>
      <eval token="strSearch">$job.search$</eval>
        Results: $resCount$ <br/>
        Search: $strSearch$


The job.resultCount returns the correct number to the post-processing search.  I.e. if the base search returns 1000 rows, and the post search returns 50, the $resCount$ token tells me 50.  However, the $strSearch$ shows me only the query for the base search.  Is there another job property I could use which will show me the entire query including the pose-processing portion? I.e. index=abc | stats count by fieldA, fieldB | search fieldA="xyz"

Labels (1)
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!