Dashboards & Visualizations

Display full SPL from job properties for a post-process search

KenL
Explorer

When debugging a dashboard sometimes it's helpful to be able to see the search that was ran with all the token values.  To do this, I sometimes add inline HTML to show me the query strings so that I don't have to keep opening a new window to view what it is that broke the search.  However, this worked fine until I started debugging post-process searches.  Here's an example:

 

<input type=dropdown token="filterZ">
  ....
</input>
<search id="base">
  <query>index=abc | stats count by fieldA, fieldB</query>
</search>

<search base="base">
  <query>| search fieldA="$filterZ$"</query>
    <progress>
      <eval token="resCount">$job.resultCount$</eval>
      <eval token="strSearch">$job.search$</eval>
    </progress>
</search>
 
<row>
  <panel>
    <html>
      <div>
        Results: $resCount$ <br/>
        Search: $strSearch$
      </div>
    </html>
  </panel>
</row>

 

The job.resultCount returns the correct number to the post-processing search.  I.e. if the base search returns 1000 rows, and the post search returns 50, the $resCount$ token tells me 50.  However, the $strSearch$ shows me only the query for the base search.  Is there another job property I could use which will show me the entire query including the pose-processing portion? I.e. index=abc | stats count by fieldA, fieldB | search fieldA="xyz"

Labels (1)
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...