Splunk Search

Tokens not being resolved by SearchManager

bowesmana
SplunkTrust
SplunkTrust

I am creating a SearchManager

  var detailSearch = new SearchManager({
    id: 'detailSearch',
    earliest_time: '-24h@h',
    latest_time: 'now',
    preview: true,
    cache: false,
    search: '| inputlookup dc_enrichment where _key IN ($parm_add_selection$)' +
          ...
  }, {tokens: true, tokenNamespace: 'submitted'});

and all works fine. However, I am then clearing the search to stop if re-running when the $parm_add_selection$ token changes with

      search.settings.set('search', null);

When I put back the original search with the search.settings.set(), the search does not find the results, because the search does not resolve the token and in the search.log shows it is trying to search for $parm_add_selection$

Does anyone know what the

{tokens: true, tokenNamespace: 'submitted'}

statement does in the initial constructor and if that is relevant to the problem?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Looks like if I wrap the re-setting of the original string in mvc.tokenSafe(), it then works.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...