Reporting

Question Regrading savedsearch

jangid
Builder

When I issue following command I'll get some result

savedsearch=list_ini

but If I issue below command I didn't get any result

savedsearch list_ini

Here is my savedsearch.conf in default directory

[list_ini]
is_visible = false
search = sourcetype=ini

Similarly If I use savedsearch command in Advanced XML I'am getting following error.

The saved search transaction_success_telnet cannot run as part of a search as it contains non search commands. Please use the savedsearch command.

Here is the saved search for transaction_success_telnet

[transaction_success_telnet]
is_visible = false
search = sourcetype="LOG" COUNTERS | streamstats first(OFS_SourceType) as OFS_SourceType, last(AUTHORISER) as AUTHORISER, last(DATE_TIME) as DATE_TIME, last(INPUTTER) as INPUTTER, last(CURR_NO) as CURR_NO | table MessageID, OFS_SourceType, AUTHORISER, DATE_TIME, INPUTTER, CURR_NO | where  OFS_SourceType="TELNET"

Advanced XML

   .....
    .....
    <param name="staticFieldsToDisplay">
            <list>
                <param name="value">savedsearch=transaction_success_session</param>
                <param name="label">SESSION</param>
            </list>
            <list>
            <param name="value">savedsearch=transaction_success_batch</param>
              <param name="label">BATCH</param>
            </list>
            <list>
                <param name="value">savedsearch=transaction_success_globus</param>
                <param name="label">GLOBUS</param>
            </list>
            <list>
            <param name="value">savedsearch=transaction_success_telnet</param>
              <param name="label">TELNET</param>
            </list>
          </param>
        ........
        ........

can anyone tell me what is right way to use savedsearch in advanced xml?

0 Karma
1 Solution

jonuwz
Influencer

You invoke saved searches in the search bar like this :

| savedsearch "Top five sourcetypes"

(note the pipe at the front)

From the look of your XML snippet, you want the user to be able to select from a list of saved searches. If you want the search to run now, and not use cached events (i.e. your saved search is not scheduled - the syntax of your question implies this)

You could do something like this :

<?xml version="1.0"?>
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>Example</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>

  <module name="StaticSelect" layoutPanel="mainSearchControls">
    <param name="label">search </param>
    <param name="settingToCreate">search_selecter</param>
    <param name="searchWhenChanged">True</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="value">Errors in the last hour</param>
        <param name="label">Latest errors</param>
      </list>
      <list>
        <param name="value">Top five sourcetypes</param>
        <param name="label">Top Sourcetypes</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">search_selecter</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="selected_search">
            <param name="fillOnEmpty">True</param>
            <param name="prefix">"</param>
            <param name="suffix">"</param>
            <param name="value">$target$</param>
          </param>
        </param>
      </param>
      <module name="HiddenSearch">
        <param name="search">| savedsearch $selected_search$</param>
        <module name="SubmitButton" layoutPanel="mainSearchControls">
          <module name="SimpleResultsTable" layoutPanel="panel_row1_col1"/>
        </module>
      </module>
    </module>
  </module>
</view>

Retrieving cached data from a scheduled search, chosen from a drop down list, is altogether more difficult.

View solution in original post

jonuwz
Influencer

You invoke saved searches in the search bar like this :

| savedsearch "Top five sourcetypes"

(note the pipe at the front)

From the look of your XML snippet, you want the user to be able to select from a list of saved searches. If you want the search to run now, and not use cached events (i.e. your saved search is not scheduled - the syntax of your question implies this)

You could do something like this :

<?xml version="1.0"?>
<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>Example</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>

  <module name="StaticSelect" layoutPanel="mainSearchControls">
    <param name="label">search </param>
    <param name="settingToCreate">search_selecter</param>
    <param name="searchWhenChanged">True</param>
    <param name="staticFieldsToDisplay">
      <list>
        <param name="value">Errors in the last hour</param>
        <param name="label">Latest errors</param>
      </list>
      <list>
        <param name="value">Top five sourcetypes</param>
        <param name="label">Top Sourcetypes</param>
      </list>
    </param>
    <module name="ConvertToIntention">
      <param name="settingToConvert">search_selecter</param>
      <param name="intention">
        <param name="name">stringreplace</param>
        <param name="arg">
          <param name="selected_search">
            <param name="fillOnEmpty">True</param>
            <param name="prefix">"</param>
            <param name="suffix">"</param>
            <param name="value">$target$</param>
          </param>
        </param>
      </param>
      <module name="HiddenSearch">
        <param name="search">| savedsearch $selected_search$</param>
        <module name="SubmitButton" layoutPanel="mainSearchControls">
          <module name="SimpleResultsTable" layoutPanel="panel_row1_col1"/>
        </module>
      </module>
    </module>
  </module>
</view>

Retrieving cached data from a scheduled search, chosen from a drop down list, is altogether more difficult.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...