Splunk 6.3 New Search Results Setter

[ksi_custr]

Hi All,

Has anybody tried to use the New Search Results setter in 6.3? I am trying to pass the search field results on a token however it is not working. Based on the splunk docs, just use $result.[fieldname]$. Below is my sample xml code.

<dashboard>
  <label>Search Result Setter</label>
  <description>Set tokens from the search manager to embed throughout the page.</description>
  <row>
    <panel>
      <title>Test</title>
      <table>
        <title>First sourcetype ($first_sourcetype$)</title>
        <search>
          <query>index=_internal |  top sourcetype</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
          <progress>
            <set token="first_sourcetype">$result.sourcetype$</set>
          </progress>
          <cancelled>
            <unset token="first_sourcetype"></unset>
          </cancelled>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>
</dashboard>

Thanks,

[piUek]

Please refer to the http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML - there is no cancelled tag there. Check the below code, which sets the token as the search finalizes (finalized).

<dashboard>
  <label>Search Result Setter</label>
  <description>Set tokens from the search manager to embed throughout the page.</description>
  <row>
    <panel>
      <title>Test</title>
      <table>
        <title>First sourcetype ($first_sourcetype$)</title>
        <search>
          <query>index=_internal | top sourcetype</query>
          <earliest>-60m</earliest>
          <latest>now</latest>
          <progress>
            <set token="first_sourcetype">$result.sourcetype$</set>
          </progress>
          <finalized>
            <set token="first_sourcetype">$result.sourcetype$</set>
          </finalized>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.legend.placement">none</option>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>

[rakesh_498115]

Hi PiUek,

Can we refer to all the the rows in the search results instead of only a first row ??

is this is possible in Splunk ??

thanks,
Rakesh.