Dashboards & Visualizations
Highlighted

Search event handler not being executed...

Contributor

I am using Splunk Enterprise 6.4.7.

Created a dashboard panel. I want to include the number of results in the panel title. I'm trying to use the job.resultCount token in the event handler. I've also tried to use

This is my panel:

<form>
  <row>
    <panel>
      <table>
        <title>$numSrchResults$ Results Returned</title>
        <search>
          <query>index=foo | table _time, name, bar, foobar</query>
          <earliest>$timer_tok.earliest$</earliest>
          <latest>$timer_tok.latest$</latest>
          <done>
              <condition>
                 <eval token="numSrchResults">'job.resultCount'</eval>
              </condition>
          </done>
        </search>
        <option name="rowNumbers">true</option>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>

My search returns about 35 results in the table. However, the token $numSrchResults$ never gets set. I've tried several different things: $job.resultCount$, 'job.resultCount', using <set></set> instead of <eval></eval>, specifying a match condition, using finalize instead of done. None of these work. Any ideas?

0 Karma
Highlighted

Re: Search event handler not being executed...

Legend

Hi lyndac,
in my dashboard I always use to put between search tags:

<progress>
     <set token="my_token">$job.resultCount$</set>
</progress>
<cancelled>
     <unset token="my_token"></unset>
</cancelled>

an it runs!

Bye.
Giuseppe

0 Karma
Highlighted

Re: Search event handler not being executed...

SplunkTrust
SplunkTrust

Hi lyndac,

You can use $job.resultPreviewCount$ for preview count.

Can you please try below XML??

<form>
  <fieldset submitButton="false">
    <input type="time" token="timer_tok">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>$numSrchResults$ Results Returned</title>
        <search>
           <query>index=foo | table _time, name, bar, foobar</query>
          <earliest>$timer_tok.earliest$</earliest>
          <latest>$timer_tok.latest$</latest>
          <progress>
              <set token="numSrchResults">$job.resultPreviewCount$</set>
          </progress>
          <cancelled>
              <unset token="numSrchResults"></unset>
          </cancelled>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>
</form>
0 Karma
Highlighted

Re: Search event handler not being executed...

Contributor

I tried this and still do not get the result count displayed. My code was working when using version 6.4.3, but when we upgraded to 6.4.7, it stopped working. When I look at the generated HTML in the debugger, I do not see a function that would handle the search event. It's like the SimpleXML is not being correctly translated to HTML

0 Karma
Highlighted

Re: Search event handler not being executed...

SplunkTrust
SplunkTrust

Hi
Can you please share full XML ( hide original search and confidential values) ??

0 Karma
Highlighted

Re: Search event handler not being executed...

Contributor

Full XML is below.

   <form>
      <fieldset submitButton="false">
           <input type="time" token="timer_tok">
              <default>
                  <earliest>@d</earliest>
                  <latest>now</latest>
              </default>
           </input>
       </fieldset>
       <row>
         <panel>
           <table>
             <title>$numSrchResults$ Results Returned</title>
             <search>
               <query>index=foo | table _time, name, bar, foobar</query>
               <earliest>$timer_tok.earliest$</earliest>
               <latest>$timer_tok.latest$</latest>
               <done>
                      <set token="numSrchResults">$job.resultCount$</set>
               </done>
             </search>
             <option name="rowNumbers">true</option>
             <option name="drilldown">none</option>
           </table>
         </panel>
       </row>
     </form>

FWIW -- I converted the dashboard to HTML and added code to handle the done event, and that works. However, I should NOT have to convert to HTML just for that work. This is the code that I had to add:

search1.on("search:done", function(properties) {
setToken("numresults", properties.content.resultCount);
});

0 Karma
Highlighted

Re: Search event handler not being executed...

SplunkTrust
SplunkTrust

Hi
Does it work for you?

0 Karma
Highlighted

Re: Search event handler not being executed...

Legend

@lyndac the search event handlers to access job tokens and results tokens were changed to<progress> and <done> from Splunk Enterprise 6.5 onward. Till version 6.4 they were <preview> and <finalized>. Try your dashboard with <finalized> instead of <done> and hopefully it should work. http://docs.splunk.com/Documentation/Splunk/6.4.7/Viz/EventHandlerReference#finalized

 <finalized>
     <set token="numSrchResults">$job.resultCount$</set>
 </finalized>

Please try out and confirm.

PS: <preview> and <finalized> have been removed since 6.5. So, you will have to reconsider moving back to <progress> or <done> when you plan your next upgrade.

0 Karma
Highlighted

Re: Search event handler not being executed...

Contributor

I've tried , , even
I've tried using $job.resultCount$ and 'job.resultCount'
None are working.

0 Karma
Highlighted

Re: Search event handler not being executed...

Legend

Or just to test whether our event handlers are being invoked... It should hit one of the conditions either default to 0 or show some value (may be null in your case if it does not work 😞 )

  <finalized>
      <condition match="$job.resultCount$==0">
           <set token="numSrchResults">0</set>
      </condition>
      <condition>
           <set token="numSrchResults">$job.resultCount$</set>
      </condition>
  </finalized>

Try something similar with <preview> instead of <finalized>
So many hit and trials would be frustrating so it is better you open up a support case with Splunk to have them look at the issues you are facing. Ideally this should have worked.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.