Splunk Search
Highlighted

Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Path Finder

I want to be able to use my search for a few things, i.e. a table then further search or html display based on certain values in the first row of results.

In advanced XML and Sideview I used to be able to get information from the first row of a search's results by using $results[0].fieldname$.

Can I do something similar in simple xml?

Thanks!

Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Splunk Employee
Splunk Employee

To my knowledge there aren't any tokens in Simple XML that are auto-populated by running searches.

You could create a SearchManager in JS and grab the results from that directly.

Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Path Finder

Can't do that unfortunately as I don't have permission to upload js files - if I could include js in the dashboard I'd be good... but I can't seem to.

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Splunk Employee
Splunk Employee

Yeah there's no way to inline JS in Simple XML. It has to be included via [form script="fooinappserver_static.js].

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

SplunkTrust
SplunkTrust

Technically you could include inline JS in HTML dashboards converted from SimpleXML. Good to start development, bad for maintenance and larger-scale deployment later.

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Path Finder

Yup, which is why I don't want to do it that way.
It really would be helpful (for maintenance) to have inline JavaScript - anyone know if it's on the plan?

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Splunk Employee
Splunk Employee

[script] tags are explicitly stripped out of [html] blocks in Simple XML, which leads me to believe that inline JS is explicitly not on the plan due to security issues. If a regular visitor could edit a dashboard and insert [script] tags in an [html] block, you could potentially have cookie-stealing code and other issues.

Anyone on the Simple XML team with a more authoritative answer?

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Path Finder

I think it should be our choice (as developers of a dashboard) if we are prepared to accept any risks. It opens up SO many options of things we can do to improve our dashboards. We have been doing this a lot in advanced XML, but if the trend is towards simple XML, then this feature is really important to allow us to make our dashboards usable and maintainable.

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Communicator

see my answer below

0 Karma
Highlighted

Re: Is there a way to create a token from search results in simple XML similar to $results[0].fieldname$ in advanced XML?

Splunk Employee
Splunk Employee

I have had the need to do this myself a few times, and I just figured it out. What you want to do is create a token that you can reference in HTML. To do this dynamically, we can use a form input. The important parts here are:

  1. Use a dropdown input.
  2. Create a search that gives you the result that you want to tokenize.
  3. Hide the input by assigning a dummy depends token in the input type.
  4. Set the * selectFirstChoice* parameter to true.

      <input type="dropdown" token="last_update" searchWhenChanged="true" depends="$justHideMe$">
        <label>last_update</label>
        <search>
          <query>index=my_data_updates | head 1 | convert timeformat="%H:%M:%S on %m/%d/%Y" ctime(_time) AS last_update | table last_update</query>
        </search>
        <fieldForLabel>last_update</fieldForLabel>
        <fieldForValue>last_update</fieldForValue>
        <selectFirstChoice>true</selectFirstChoice>
      </input>
    

You can now reference $last_update$ in your HTML panels.

Check out my example "last updated" dashboard at the bottom of this App:

https://splunkbase.splunk.com/app/2919/