Splunk Search

Dynamic saved search - How do I initialize search tokens in spl?

hschuhkn
Engager

I like to use savedsearches with token inside  a classic xml dashboards e.g. 

<form>
...
<search>
<query>| savedsearch "my_savedsearch " tok_token1="$form.tok_token1$" tok_token2="$form.tok_token2$" ..."
</query>
</search>
...
</form>


But when I want to edit the savedsearch later in the search app/dashboard, the tokens are not set, e.g.

> index=xyz field1=$tok_token1$  AND field2=$tok_token2$

The only way to run and edit the query  I know is to replace temporary the token to constant values, because something like 
> | eval tok_token1=value 
before does not work.
Is there a better way to temporary set the tokens in a  dynamic search for enhancing a query afterwards ?




Labels (1)
0 Karma

jdunlea
Contributor

I am not entirely sure that I understand what you are asking, but I think you are looking for a way to run the query without having to replace all of the tokens?

 

If so, you can always try and run the dashboard, and then open the panel in the search window, as shown below. 

jdunlea_0-1664980552957.png

 

Then when the search is open in a new window, it will run with the variables that you set in your dashboard (so you do not have to enter them in). Now you can change the search and enhance the query and when you are done, you can copy the enhanced part of the query and bring it back to your dashboard. 

 

Just be careful, if you copy the FULL query and bring it back to your dashboard, then the full query will not have the $tokens$ in the query, so then you will have to replace them before saving the updated query in the dashboard. 

 

The easiest thing is to just copy only the updated part of the query and then bring that back to the dashboard. 

0 Karma

hschuhkn
Engager

Thanks for reply and the question is understood perfectly. When I open the query in the dashboard with the magnifying glass, I also get a new search window with a "| savedsearch field=$token1$" query. So currently I have to temporary edit the savedsearch replace the token with values, test the query and replace the values with token back before saving the search. So i still hope for a nicer solution, to just add one initializing line in the spl like 
| eval field = if (isnull($token$) , value, $token$)
which does not work.

It would make editing and developing dynamic saved search much easier.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

You can post the ask in ideas.splunk.com.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...