Dashboards & Visualizations

How can I pass a boolean string in token

tkwaller1
Path Finder

Hello

 

Im working on testing something but Im not sure exactly would be the best solution. What I am trying to do is, using the timepicker, have a panel that loads id's. Then I'd like another panel to search over the same timespan, in a different dataset, but only for the id's from the first panel.


Is there a way to pass the results of a search that runs on page load to another search, maybe with a token(s)? the catch is that there may be a single id or there may be many id's. It would have to be a boolean of some sort I believe unless there's a better way to search one to many instances of a something.
 
My thinking is something like 
search 1:
<base search> | stats count by MSGID | fields - count
that populates a <tok> on page load(or time selection) but the results would have to be formatted like 

 

654165464 OR MSGID=584548549494 OR MSGID=54654645645

 


search 2
<base search2> MSGID=<tok> | stats count by MSGID | fields - count

Is this something that can be done? What might I have to do to accomplish this?

Thanks for the assistance!

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, I believe it can be done.  The first search should be followed by a <done> element within which a token is set to one of the result fields of the search.  That token is then referenced in the second search.

<search><query>blahblahblah</query>
  <done>
    <set token=foo>$results.foo$</set>
  </done>
</search>

If the second search expects the contents of the token to be in a particular format then the query should generate that format or you may be able to use an <eval> element within <done> to produce the desired structure.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Yes, I believe it can be done.  The first search should be followed by a <done> element within which a token is set to one of the result fields of the search.  That token is then referenced in the second search.

<search><query>blahblahblah</query>
  <done>
    <set token=foo>$results.foo$</set>
  </done>
</search>

If the second search expects the contents of the token to be in a particular format then the query should generate that format or you may be able to use an <eval> element within <done> to produce the desired structure.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...