I regularly get requests for some data that I get from several searches. The people requesting it like it formatted just so, so instead of manually formatting it each time I'd like to have my searches in a dashboard with all the needed data being sent to an html panel so I can format it correctly.
Can someone please help direct me to what I'm doing wrong? I've tried changing the table to a single value and tried various ways to set the token.
Run anywhere:
<dashboard>
<label>test</label>
<row>
<panel>
<table>
<search>
<query>| metadata type=hosts | head 1</query>
<earliest>-60m</earliest>
<latest>now</latest>
<condition match="'job.isDone'">
<set token="MyHost">$results.host$</set>
</condition>
</search>
</table>
</panel>
<panel>
<html>
<p>Host: $MyHost$</p>
</html>
</panel>
</row>
</dashboard>
I get back:
firstTime host lastTime recentTime totalCount type
1476644722 myHostName 1476736882 1476736882 154103 hosts
and Host: $MyHost$
instead of Host: myHostName
Thank you!
try setting the job.isDone equal to 1, so that it has to be true to set the token?
<search>
<query>...</query>
<done>
<condition match="'job.isDone'"=1>
<set token="host">$result.host$</set>
</condition>
</done>
</search>
</panel>
<html>
$host$
</html>