Splunk Search

Tokens not being resolved by SearchManager

bowesmana
SplunkTrust
SplunkTrust

I am creating a SearchManager

  var detailSearch = new SearchManager({
    id: 'detailSearch',
    earliest_time: '-24h@h',
    latest_time: 'now',
    preview: true,
    cache: false,
    search: '| inputlookup dc_enrichment where _key IN ($parm_add_selection$)' +
          ...
  }, {tokens: true, tokenNamespace: 'submitted'});

and all works fine. However, I am then clearing the search to stop if re-running when the $parm_add_selection$ token changes with

      search.settings.set('search', null);

When I put back the original search with the search.settings.set(), the search does not find the results, because the search does not resolve the token and in the search.log shows it is trying to search for $parm_add_selection$

Does anyone know what the

{tokens: true, tokenNamespace: 'submitted'}

statement does in the initial constructor and if that is relevant to the problem?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Looks like if I wrap the re-setting of the original string in mvc.tokenSafe(), it then works.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...