Splunk Search

Splunk 6.5.0: How to access the first row from the search result in a dashboard?

Explorer

Recently upgraded to Splunk 6.5.0. I am trying to access the first row from the search result in a dashboard. In version 6.3.2, there was an event handler 'finalized' which provides access to the first row

Documentation from version 6.3.2 : http://docs.splunk.com/Documentation/Splunk/6.3.2/Viz/tokens#Define_search_tokens

But in 6.5.0 there is no 'finalized' handler. Only handlers available are progress, done, cancel, error, fail and none of those provide access to first row of the result

Documentation from version 6.5.0: http://docs.splunk.com/Documentation/Splunk/6.5.0/Viz/tokens#Define_search_tokens

Is there any workaround? Is it done differently in 6.5.0?

Explorer

I think its a typo in the 6.5 documentation. The done handler provides access to first row of the result. When I tried to access result.field-name in the done handler it worked . I tried eval to set the token which did not work but set token worked.

Champion

Please put a comment on the documentation page asking them to update the table. They will typically do it pretty quickly.

0 Karma

Path Finder

eval works for me using eg. tostring($result.$)

0 Karma

Super Champion

In your search, can you just add |head 1

0 Karma

Champion

I am not sure you understand. @adevi is trying to use the $result.FIELD$ feature that was in 6.3 and 6.4, but seems to be gone in 6.5. This feature allowed one to assign the result from the first row to a token for other uses in the Dashboard.

0 Karma

Super Champion

Yeah I know that it tokens it. But then if they only brought the one row back, they could use done or another to token.

0 Karma

Champion

This is quite frustrating if they took out <finalized> without giving comparable capabilities in SimpleXML. Can someone from Splunk please clarify.

0 Karma