Dashboards & Visualizations

How to set a token for XML dashboard using an event handler to represent when a search is complete?

kmfpo
Explorer

I want to set the title of one of my dashboards after the search is complete. I have tried using various event handlers but can't get the token to set. What am I missing?

<search base="myBaseSearch">
  <query> | search foo</query>
    <done>
       <condition match=" 'job.isDone' == true">
         <set token="col1_token">$result.col1$</set>
       </condition>
    </done>
</search>
0 Karma

jconger
Splunk Employee
Splunk Employee

You should not need the condition since the done event handler fires when the job is, well, done...

Here is an example:

<form>
  <label>Start a search after another search finishes</label>
  <description>This dashboard demonstrates how to start a second search after a primary search finishes.  This is accomplished by using the &lt;done&gt; event handler in the &lt;search&gt; element.</description>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Primary Search</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd | table host source sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="start">$job.earliestTime$</set>
            <set token="end">$job.latestTime$</set>
          </done>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>This search happens after the above search is finished</title>
      <chart>
        <search>
          <query>index=_internal | timechart count as total count(eval(sourcetype="splunkd")) as "splunkd"</query>
          <earliest>$start$</earliest>
          <latest>$end$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.fields">splunkd</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">splunkd</option>
        <option name="charting.fieldColors">{"total": 0x639BF1, "splunkd":0xFF5A09}</option>
        <option name="charting.legend.masterLegend">null</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">300</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

kmfpo
Explorer

So I have a default value for col1 that is "Pending completion of search". What I wanted was for col1 to input its value once the query is complete (using a base search). I want it to keep the "Pending completion of search" until the search is actually done. For some reason, my dashboard displays

This dashboard is Pending completion of search (1second)
..
changes to
..
This dashboard is $result.col1$"
..
query finishes 10 seconds later
..
This dashboard is Acceptable

0 Karma

jconger
Splunk Employee
Splunk Employee

It would be helpful to post your dashboard's XML.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...

Network to App: Observability Unlocked [May & June Series]

In today’s digital landscape, your environment is no longer confined to the data center. It spans complex ...

SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...