Dashboards & Visualizations

How to display full search string with job inspection when using base searches?

KenL
Explorer

I often use job inspector to troubleshoot my dashboards. I add the following code after my query:

 <progress><eval token="strSearch">$job.search$</eval></progress>

And add the following html which shows me the search string while I'm in Edit mode.  This is very handy as it helps with troubleshooting for search syntax errors as well as displaying all the token values that constructed the search string:

  <row><panel><html><pre>$strSearch$ </pre></html></panel></row>

This all works fine except when my query is based on a base search (i.e. I'm doing post-processing searches).  Then the above code only shows me the base search portion but not the full search.  

Is there a way to display the full search?

Labels (2)
0 Karma

woodcock
Esteemed Legend

Nope.  You will have to do the same thing in both places and glue the 2 pieces together.

0 Karma

KenL
Explorer

Well, that's the problem.  I DID place the job.search code in both places (assigned to different token name of course).  Yet, the job.search property for both the base search and the post-search returned the same values showing the base search only.  I couldn't get the 2nd half of my search to display.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...