Search event handler not being executed...

[lyndac]

I am using Splunk Enterprise 6.4.7.

Created a dashboard panel. I want to include the number of results in the panel title. I'm trying to use the job.resultCount token in the event handler. I've also tried to use

This is my panel:

<form>
  <row>
    <panel>
      <table>
        <title>$numSrchResults$ Results Returned</title>
        <search>
          <query>index=foo | table _time, name, bar, foobar</query>
          <earliest>$timer_tok.earliest$</earliest>
          <latest>$timer_tok.latest$</latest>
          <done>
              <condition>
                 <eval token="numSrchResults">'job.resultCount'</eval>
              </condition>
          </done>
        </search>
        <option name="rowNumbers">true</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

My search returns about 35 results in the table. However, the token $numSrchResults$ never gets set. I've tried several different things: $job.resultCount$, 'job.resultCount', using <set></set> instead of <eval></eval>, specifying a match condition, using finalize instead of done. None of these work. Any ideas?

[niketn]

@lyndac the search event handlers to access job tokens and results tokens were changed to<progress> and <done> from Splunk Enterprise 6.5 onward. Till version 6.4 they were <preview> and <finalized>. Try your dashboard with <finalized> instead of <done> and hopefully it should work. http://docs.splunk.com/Documentation/Splunk/6.4.7/Viz/EventHandlerReference#finalized

 <finalized>
     <set token="numSrchResults">$job.resultCount$</set>
 </finalized>

Please try out and confirm.

PS: <preview> and <finalized> have been removed since 6.5. So, you will have to reconsider moving back to <progress> or <done> when you plan your next upgrade.

[lyndac]

I've tried , , even
I've tried using $job.resultCount$ and 'job.resultCount'
None are working.

[niketn]

Or just to test whether our event handlers are being invoked... It should hit one of the conditions either default to 0 or show some value (may be null in your case if it does not work 😞 )

  <finalized>
      <condition match="$job.resultCount$==0">
           <set token="numSrchResults">0</set>
      </condition>
      <condition>
           <set token="numSrchResults">$job.resultCount$</set>
      </condition>
  </finalized>

Try something similar with <preview> instead of <finalized>
So many hit and trials would be frustrating so it is better you open up a support case with Splunk to have them look at the issues you are facing. Ideally this should have worked.

[kamlesh_vaghela]

Hi lyndac,

You can use $job.resultPreviewCount$ for preview count.

Can you please try below XML??

<form>
  <fieldset submitButton="false">
    <input type="time" token="timer_tok">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$numSrchResults$ Results Returned</title>
        <search>
           <query>index=foo | table _time, name, bar, foobar</query>
          <earliest>$timer_tok.earliest$</earliest>
          <latest>$timer_tok.latest$</latest>
          <progress>
              <set token="numSrchResults">$job.resultPreviewCount$</set>
          </progress>
          <cancelled>
              <unset token="numSrchResults"></unset>
          </cancelled>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>

[lyndac]

I tried this and still do not get the result count displayed. My code was working when using version 6.4.3, but when we upgraded to 6.4.7, it stopped working. When I look at the generated HTML in the debugger, I do not see a function that would handle the search event. It's like the SimpleXML is not being correctly translated to HTML

[lyndac]

Full XML is below.

   <form>
      <fieldset submitButton="false">
           <input type="time" token="timer_tok">
              <default>
                  <earliest>@d</earliest>
                  <latest>now</latest>
              </default>
           </input>
       </fieldset>
       <row>
         <panel>
           <table>
             <title>$numSrchResults$ Results Returned</title>
             <search>
               <query>index=foo | table _time, name, bar, foobar</query>
               <earliest>$timer_tok.earliest$</earliest>
               <latest>$timer_tok.latest$</latest>
               <done>
                      <set token="numSrchResults">$job.resultCount$</set>
               </done>
             </search>
             <option name="rowNumbers">true</option>
             <option name="drilldown">none</option>
           </table>
         </panel>
       </row>
     </form>

FWIW -- I converted the dashboard to HTML and added code to handle the done event, and that works. However, I should NOT have to convert to HTML just for that work. This is the code that I had to add:

search1.on("search:done", function(properties) {
setToken("numresults", properties.content.resultCount);
});

[kamlesh_vaghela]

Hi
Does it work for you?

[kamlesh_vaghela]

Hi
Can you please share full XML ( hide original search and confidential values) ??

[gcusello]

Hi lyndac,
in my dashboard I always use to put between search tags:

<progress>
     <set token="my_token">$job.resultCount$</set>
</progress>
<cancelled>
     <unset token="my_token"></unset>
</cancelled>

an it runs!

Bye.
Giuseppe