Dashboards & Visualizations

How to set a token for XML dashboard using an event handler to represent when a search is complete?

kmfpo
Explorer

I want to set the title of one of my dashboards after the search is complete. I have tried using various event handlers but can't get the token to set. What am I missing?

<search base="myBaseSearch">
  <query> | search foo</query>
    <done>
       <condition match=" 'job.isDone' == true">
         <set token="col1_token">$result.col1$</set>
       </condition>
    </done>
</search>
0 Karma

jconger
Splunk Employee
Splunk Employee

You should not need the condition since the done event handler fires when the job is, well, done...

Here is an example:

<form>
  <label>Start a search after another search finishes</label>
  <description>This dashboard demonstrates how to start a second search after a primary search finishes.  This is accomplished by using the &lt;done&gt; event handler in the &lt;search&gt; element.</description>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Primary Search</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd | table host source sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="start">$job.earliestTime$</set>
            <set token="end">$job.latestTime$</set>
          </done>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>This search happens after the above search is finished</title>
      <chart>
        <search>
          <query>index=_internal | timechart count as total count(eval(sourcetype="splunkd")) as "splunkd"</query>
          <earliest>$start$</earliest>
          <latest>$end$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.fields">splunkd</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">splunkd</option>
        <option name="charting.fieldColors">{"total": 0x639BF1, "splunkd":0xFF5A09}</option>
        <option name="charting.legend.masterLegend">null</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">300</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

kmfpo
Explorer

So I have a default value for col1 that is "Pending completion of search". What I wanted was for col1 to input its value once the query is complete (using a base search). I want it to keep the "Pending completion of search" until the search is actually done. For some reason, my dashboard displays

This dashboard is Pending completion of search (1second)
..
changes to
..
This dashboard is $result.col1$"
..
query finishes 10 seconds later
..
This dashboard is Acceptable

0 Karma

jconger
Splunk Employee
Splunk Employee

It would be helpful to post your dashboard's XML.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...