How to dispatch a saved search with parameters using the Javascript SDK

[yoxigen]

If I dispatch a saved search with no parameters (like $IP$, $HOST$, $username$, etc), it runs properly and returns result, but for some reason when dispatching a search with parameters, I get no rows in the result.

Here's how I'm sending the search with params:

mySavedSearch.dispatch({ "dispatch.IP": "192.168.0.1" }, function(err, job) { ... }

I got this from the SavedSearch documentation:
http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.1/splunkjs.Service.SavedSearch.html#splun...

Can anyone advise me how to run a saved search with the Javascript SDK, with parameters?

Thanks!
Yossi.

[Neeraj_Luthra · Accepted solution]

There are a few dispatch specific arguments you can pass like bucket, max_count, earliest_time etc. You can get the full list at savedsearches.conf.

The parameters that you are trying to use are substituted slightly differently. Here is an example ...

Sample saved search query with host as one of the parameters that I want to substitute at runtime:

index=fooindex sourcetype=foosourcetype host=$args.host$

Sample JS code to dispatch with argument substitution:

mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) {

You can bind multiple parameters in the call above depending on your need. Remember to specify args along with your parameter name as mentioned above.

[Neeraj_Luthra]

Agreed. We have this documented for our Java and C# SDKs but we need to port this information into other SDKs as well.

[yoxigen]

Thanks Neeraj, this really helps!

In the Javasript SDK documentation it doesn't say anything about having to specify the saved search parameters as "$args.host" instead of "$host", but that's what I was missing.

It'd be great for others looking for the same information if an example was added to the Javascript SDK API reference under SavedSearch.dispatch.