Dashboards & Visualizations

help on issue with a savedsearch and a token from a dropdown list

jip31
Motivator

Hello

I use the code below in all my dashboard searches in order to filter results by SITE from a dropdown list and it works perfectly

| lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 

But I need to use savedsearches in my dashboard
So I call a search from my dshboard like this

| loadjob savedsearch="admin:SA_xxxx_xx_xx_xx_xx_sh:Hardware - Battery last 10"   
| search SITE=$tok_filtersite|s$ 

And I keep | lookup lookup_cmdb_fo_all.csv HOSTNAME as host output SITE in the search
But I have no results only when I delete | search SITE=$tok_filtersite|s$ ...
So there is an issue with this token in the savedsearches
What I have to do please??

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Are you getting SITE info after executing savedsearch

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Are you getting SITE info after executing savedsearch

0 Karma

jip31
Motivator

hi
I dont understand what you mean
what I need is to :
1) execute my search in a savedsearch
2) filter the data by SITE from the dropdown list in the dashboard (tok_filtersite)

0 Karma

jip31
Motivator

if i am doing this I have no results so I ont get the SITE
| loadjob savedsearch="admin:xxxxx:Hardware - Battery last 10"
| search SITE=*

0 Karma

jip31
Motivator

oh I think I have found
its because in the search I rename SITE by Site
so | search SITE=$tok_filtersite|s$ has to be replaced by | search Site=$tok_filtersite|s$

0 Karma

vnravikumar
Champion

Whether it's working now?

0 Karma

jip31
Motivator

Yes
if I do | loadjob savedsearch="admin:xxxxx:Hardware - Battery last 10"
| search Site=* it works

0 Karma

vnravikumar
Champion

Good to know

0 Karma

vnravikumar
Champion

Please accept to close the issue.

0 Karma

vnravikumar
Champion

Please confirm whether are you getting values after executing this statement | loadjob savedsearch="admin:xxxxx:Hardware - Battery last 10" without | search SITE=* if yes, SITE info is there?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...