Dashboards & Visualizations

How to display full search string with job inspection when using base searches?

KenL
Explorer

I often use job inspector to troubleshoot my dashboards. I add the following code after my query:

 <progress><eval token="strSearch">$job.search$</eval></progress>

And add the following html which shows me the search string while I'm in Edit mode.  This is very handy as it helps with troubleshooting for search syntax errors as well as displaying all the token values that constructed the search string:

  <row><panel><html><pre>$strSearch$ </pre></html></panel></row>

This all works fine except when my query is based on a base search (i.e. I'm doing post-processing searches).  Then the above code only shows me the base search portion but not the full search.  

Is there a way to display the full search?

Labels (2)
0 Karma

woodcock
Esteemed Legend

Nope.  You will have to do the same thing in both places and glue the 2 pieces together.

0 Karma

KenL
Explorer

Well, that's the problem.  I DID place the job.search code in both places (assigned to different token name of course).  Yet, the job.search property for both the base search and the post-search returned the same values showing the base search only.  I couldn't get the 2nd half of my search to display.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...