Splunk Search

Token Not Ready When Search Executes on Page Load

tomapatan
Communicator

Hi all,

I’ve got a dashboard that uses a JS script to dynamically set the $row_count_tok$ token based on screen orientation:

  • 24 for landscape (2 pages of 12 rows)
  • 40 for portrait (2 pages of 20 rows)

I pass this token into my search to determine how many rows to return, and then paginate them like so:

......
| head $row_count_tok$
| streamstats count as Page
| eval Page = case(
    $row_count_tok$=24 AND Page<=12, 0,
    $row_count_tok$=24 AND Page>12, 1,
    $row_count_tok$=40 AND Page<=20, 0,
    $row_count_tok$=40 AND Page>20, 1
)
| eval display = floor(tonumber(strftime(now(), "%S")) / 10) % 2
| where Page = display
| fields - display

The token and logic work (tested manually), but I get this message on page load indicating the token was not ready when the search ran:

 Search is waiting for input...

How do I force the query to wait for the token to load ?

Many thanks.

Labels (1)
0 Karma
1 Solution

tomapatan
Communicator

Managed to get this resolved by ensuring the submitted token model was updated by adding submittedTokenModel.set() and submittedTokenModel.trigger() to the code.


The title displaying the token value was a bit of a red herring. It showed that the default model was being updated, but it didn't reflect the state of the submitted token model.

View solution in original post

tomapatan
Communicator

Managed to get this resolved by ensuring the submitted token model was updated by adding submittedTokenModel.set() and submittedTokenModel.trigger() to the code.


The title displaying the token value was a bit of a red herring. It showed that the default model was being updated, but it didn't reflect the state of the submitted token model.

livehybrid
Super Champion

Hi @tomapatan 

Are you able to visualise what the row_count_tok token is set to by your JS? It sounds like the queries do not see it as being set. 

Its worth adding the token in a title or html somewhere so you can confirm. 

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

tomapatan
Communicator

For some additional context — the dashboard actually works unless I switch from portrait to landscape or the other way round. When that happens, the only way to resolve is to enter edit mode and then exit without making any changes. Simply refreshing the page doesn't work as expected, although the token does update automatically (I`ve got the token in a title so I can view it`s values).

0 Karma

tomapatan
Communicator

This is happening because I`ve got this set up, and it looks like the only way to refresh is to enter edit mode and exit without saving. Any ideas ? cc @livehybrid 

<option name="count">$row_count_tok$</option>




0 Karma

bowesmana
SplunkTrust
SplunkTrust

I have a feeling that using tokens in the count part of the XML config was broken at some point. It used to work, then it stopped working, but now I tested again, it does work - what version are you on?

 

0 Karma

tomapatan
Communicator

Done some further testing and the "Search is waiting for input.." is caused by the query below and not the count part in XML:

| head $row_count_tok$
| streamstats count as Page
| eval Page = case(
$row_count_tok$=24 AND Page<=12, 0,
$row_count_tok$=24 AND Page>12, 1,
$row_count_tok$=40 AND Page<=20, 0,
$row_count_tok$=40 AND Page>20, 1
)

But I`m not sure why, as the token is in a title and I can see it`s values being extracted correctly (24 if in landscape mode or 40 if in portrait).
If I refresh the browser the issue persists, if I go into editxml mode and cancel without making any changes the panel displays fine.

0 Karma

tomapatan
Communicator

Yes, the $row_count_tok$ is being set accordingly (24 or 40, depending on the screen orientation).

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...