Splunk Search

Why am I unable to populate a token with the result of a search with my current Simple XML?

felipetavares
Path Finder

Hello there guys,

I'm trying to populate a token with the result of a search so I'm able to use this value at various other points of the Dashboard.
The search only has the field sourcetype at the end and it should populate the token "asas" with the sourcetype, based on the search result.
This search runs and I'm able to see that it have more than zero results, based on the Job monitor.

I'm using Splunk 6.2.2 and I was reading the "Search event handlers", but couldn't make it work.

The point is that this token never gets the data set into it, maybe you someone could help me?

Dashboard code:

<dashboard>
  <label>Test Validation - $asas$</label>
  <search>
    <query>index=oneshot | head 1 | fields sourcetype</query>
    <finalized>
      <set token="asas">results.sourcetype</set>
      <condition match=" 'job.resultCount' >= 0">
        <set token="show_html">true</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </finalized>
  </search>
  <row>
    <panel>
      <title>testeeeee $asas$</title>
      <table>
        <search>
          <query>index="oneshot" search |head 1 | eval teste=$show_html$ | eval gethim=$asas$ | table GrupoNome2,gethim</query>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>asasasas</title>
      <html>
        <center>teste - $asas$</center>
      </html>
    </panel>
  </row>
</dashboard>
1 Solution

somesoni2
Revered Legend

Replace this

 <set token="asas">results.sourcetype</set>

with

 <set token="asas">$result.sourcetype$</set>

View solution in original post

somesoni2
Revered Legend

Replace this

 <set token="asas">results.sourcetype</set>

with

 <set token="asas">$result.sourcetype$</set>

felipetavares
Path Finder

Hello there @somesoni2, I did it but it didn't work either.
I was searching and I think that I will need version 6.3+ for this to work. Do you know if I'm right? :x

0 Karma

Vimalsekar
Engager

Hi,
I have a similar problem, my token $URL$ is not being set with values..the same query is working fine in another dashboard...My Splunk version 6.5.2

<query>index=MyIndex sourcetype=MySourceType  
| eval URLink = case(ENV=="PROD", "zzz.yy.xx", 1=1, "zzz-".ENV.".yy.xxx") | head 1 | table ENV URLink</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
<!--<done>
  <set token="Env">$result.ENV$</set>
  <set token="URLink">$result.URLink$</set>
</done> -->
 <finalized>
    <condition>
      <set token="URL">$result.URLink$</set>
    </condition>
 </finalized>
0 Karma

somesoni2
Revered Legend

The event handler have been updated in Splunk 6.5.x, see this for updated list of event handlers available. http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

0 Karma

somesoni2
Revered Legend

Thats correct. The option finalized for search is only available for 6.3.x version.

0 Karma

Vimalsekar
Engager

Hi @somesoni2, can u pls help me on my question above...

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...