Dashboards & Visualizations

Display full SPL from job properties for a post-process search

KenL
Explorer

When debugging a dashboard sometimes it's helpful to be able to see the search that was ran with all the token values.  To do this, I sometimes add inline HTML to show me the query strings so that I don't have to keep opening a new window to view what it is that broke the search.  However, this worked fine until I started debugging post-process searches.  Here's an example:

 

<input type=dropdown token="filterZ">
  ....
</input>
<search id="base">
  <query>index=abc | stats count by fieldA, fieldB</query>
</search>

<search base="base">
  <query>| search fieldA="$filterZ$"</query>
    <progress>
      <eval token="resCount">$job.resultCount$</eval>
      <eval token="strSearch">$job.search$</eval>
    </progress>
</search>
 
<row>
  <panel>
    <html>
      <div>
        Results: $resCount$ <br/>
        Search: $strSearch$
      </div>
    </html>
  </panel>
</row>

 

The job.resultCount returns the correct number to the post-processing search.  I.e. if the base search returns 1000 rows, and the post search returns 50, the $resCount$ token tells me 50.  However, the $strSearch$ shows me only the query for the base search.  Is there another job property I could use which will show me the entire query including the pose-processing portion? I.e. index=abc | stats count by fieldA, fieldB | search fieldA="xyz"

Labels (1)
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...