Dynamic saved search - How do I initialize search tokens in spl?

[hschuhkn]

I like to use savedsearches with token inside  a classic xml dashboards e.g. 

<form>
...
<search>
<query>| savedsearch "my_savedsearch " tok_token1="$form.tok_token1$" tok_token2="$form.tok_token2$" ..."
</query>
</search>
...
</form>


But when I want to edit the savedsearch later in the search app/dashboard, the tokens are not set, e.g.

> index=xyz field1=$tok_token1$  AND field2=$tok_token2$

The only way to run and edit the query  I know is to replace temporary the token to constant values, because something like 
> | eval tok_token1=value 
before does not work.
Is there a better way to temporary set the tokens in a  dynamic search for enhancing a query afterwards ?

[jdunlea]

I am not entirely sure that I understand what you are asking, but I think you are looking for a way to run the query without having to replace all of the tokens?

If so, you can always try and run the dashboard, and then open the panel in the search window, as shown below. 

Then when the search is open in a new window, it will run with the variables that you set in your dashboard (so you do not have to enter them in). Now you can change the search and enhance the query and when you are done, you can copy the enhanced part of the query and bring it back to your dashboard. 

Just be careful, if you copy the FULL query and bring it back to your dashboard, then the full query will not have the $tokens$ in the query, so then you will have to replace them before saving the updated query in the dashboard. 

The easiest thing is to just copy only the updated part of the query and then bring that back to the dashboard. 

[hschuhkn]

Thanks for reply and the question is understood perfectly. When I open the query in the dashboard with the magnifying glass, I also get a new search window with a "| savedsearch field=$token1$" query. So currently I have to temporary edit the savedsearch replace the token with values, test the query and replace the values with token back before saving the search. So i still hope for a nicer solution, to just add one initializing line in the spl like 
| eval field = if (isnull($token$) , value, $token$)
which does not work.

It would make editing and developing dynamic saved search much easier.

[yuanliu]

You can post the ask in ideas.splunk.com.