Splunk Search

How do I get the eval token to wait for the set token to finish?

robertlynch2020
Influencer

Hi

Is there a way to get my eval token to wait for the full result.
I am setting a token time_selection_BUFFER.earliest from a complex query so it take 5 seconds, however the eval below it is not waiting on the result.
It looks like it is passing in the value $start$ to the token time_selection_BUFFER.earliest, before it is ready.
This is an issues as i am specifically working on not refreshing the token with a CASE statement.

So the questions, how do i get eval token to wait for set token to finish?

 <selection>

        <set token="time_selection_BUFFER.earliest">$start$</set>

          <eval token="time_selection.earliest">case($time_selection.earliest$ != $time_token.earliest$ ,$time_selection_BUFFER.earliest$,true(),$time_selection.earliest$)</eval>



        </selection>
1 Solution

woodcock
Esteemed Legend

You should be using the <done> setting (or is it <finalized> now?) which triggers when the search in a panel is DONE:

<done><eval token="time_selection_BUFFER.earliest">$start$</eval></done>

View solution in original post

woodcock
Esteemed Legend

You should be using the <done> setting (or is it <finalized> now?) which triggers when the search in a panel is DONE:

<done><eval token="time_selection_BUFFER.earliest">$start$</eval></done>

robertlynch2020
Influencer

HI

Ok cool

Cheers

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...