Dashboards & Visualizations

How to set a token for XML dashboard using an event handler to represent when a search is complete?

kmfpo
Explorer

I want to set the title of one of my dashboards after the search is complete. I have tried using various event handlers but can't get the token to set. What am I missing?

<search base="myBaseSearch">
  <query> | search foo</query>
    <done>
       <condition match=" 'job.isDone' == true">
         <set token="col1_token">$result.col1$</set>
       </condition>
    </done>
</search>
0 Karma

jconger
Splunk Employee
Splunk Employee

You should not need the condition since the done event handler fires when the job is, well, done...

Here is an example:

<form>
  <label>Start a search after another search finishes</label>
  <description>This dashboard demonstrates how to start a second search after a primary search finishes.  This is accomplished by using the &lt;done&gt; event handler in the &lt;search&gt; element.</description>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Primary Search</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd | table host source sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="start">$job.earliestTime$</set>
            <set token="end">$job.latestTime$</set>
          </done>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>This search happens after the above search is finished</title>
      <chart>
        <search>
          <query>index=_internal | timechart count as total count(eval(sourcetype="splunkd")) as "splunkd"</query>
          <earliest>$start$</earliest>
          <latest>$end$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.fields">splunkd</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">splunkd</option>
        <option name="charting.fieldColors">{"total": 0x639BF1, "splunkd":0xFF5A09}</option>
        <option name="charting.legend.masterLegend">null</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">300</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

kmfpo
Explorer

So I have a default value for col1 that is "Pending completion of search". What I wanted was for col1 to input its value once the query is complete (using a base search). I want it to keep the "Pending completion of search" until the search is actually done. For some reason, my dashboard displays

This dashboard is Pending completion of search (1second)
..
changes to
..
This dashboard is $result.col1$"
..
query finishes 10 seconds later
..
This dashboard is Acceptable

0 Karma

jconger
Splunk Employee
Splunk Employee

It would be helpful to post your dashboard's XML.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...