- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Why am I unable to populate a token with the resul...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello there guys,
I'm trying to populate a token with the result of a search so I'm able to use this value at various other points of the Dashboard.
The search only has the field sourcetype at the end and it should populate the token "asas" with the sourcetype, based on the search result.
This search runs and I'm able to see that it have more than zero results, based on the Job monitor.
I'm using Splunk 6.2.2 and I was reading the "Search event handlers", but couldn't make it work.
The point is that this token never gets the data set into it, maybe you someone could help me?
Dashboard code:
<dashboard>
<label>Test Validation - $asas$</label>
<search>
<query>index=oneshot | head 1 | fields sourcetype</query>
<finalized>
<set token="asas">results.sourcetype</set>
<condition match=" 'job.resultCount' >= 0">
<set token="show_html">true</set>
</condition>
<condition>
<unset token="show_html"></unset>
</condition>
</finalized>
</search>
<row>
<panel>
<title>testeeeee $asas$</title>
<table>
<search>
<query>index="oneshot" search |head 1 | eval teste=$show_html$ | eval gethim=$asas$ | table GrupoNome2,gethim</query>
</search>
</table>
</panel>
</row>
<row>
<panel>
<title>asasasas</title>
<html>
<center>teste - $asas$</center>
</html>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Replace this
<set token="asas">results.sourcetype</set>
with
<set token="asas">$result.sourcetype$</set>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Replace this
<set token="asas">results.sourcetype</set>
with
<set token="asas">$result.sourcetype$</set>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello there @somesoni2, I did it but it didn't work either.
I was searching and I think that I will need version 6.3+ for this to work. Do you know if I'm right? :x
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a similar problem, my token $URL$ is not being set with values..the same query is working fine in another dashboard...My Splunk version 6.5.2
<query>index=MyIndex sourcetype=MySourceType
| eval URLink = case(ENV=="PROD", "zzz.yy.xx", 1=1, "zzz-".ENV.".yy.xxx") | head 1 | table ENV URLink</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
<!--<done>
<set token="Env">$result.ENV$</set>
<set token="URLink">$result.URLink$</set>
</done> -->
<finalized>
<condition>
<set token="URL">$result.URLink$</set>
</condition>
</finalized>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The event handler have been updated in Splunk 6.5.x, see this for updated list of event handlers available. http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thats correct. The option finalized for search is only available for 6.3.x version.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @somesoni2, can u pls help me on my question above...
Get Inspired! We’ve Got Validation that Your Hard Work is Paying Off
What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience
Take Your Breath Away with Splunk Risk-Based Alerting (RBA)
