Splunk Search
Highlighted

Why am I unable to populate a token with the result of a search with my current Simple XML?

Path Finder

Hello there guys,

I'm trying to populate a token with the result of a search so I'm able to use this value at various other points of the Dashboard.
The search only has the field sourcetype at the end and it should populate the token "asas" with the sourcetype, based on the search result.
This search runs and I'm able to see that it have more than zero results, based on the Job monitor.

I'm using Splunk 6.2.2 and I was reading the "Search event handlers", but couldn't make it work.

The point is that this token never gets the data set into it, maybe you someone could help me?

Dashboard code:

<dashboard>
  <label>Test Validation - $asas$</label>
  <search>
    <query>index=oneshot | head 1 | fields sourcetype</query>
    <finalized>
      <set token="asas">results.sourcetype</set>
      <condition match=" 'job.resultCount' >= 0">
        <set token="show_html">true</set>
      </condition>
      <condition>
        <unset token="show_html"></unset>
      </condition>
    </finalized>
  </search>
  <row>
    <panel>
      <title>testeeeee $asas$</title>
      <table>
        <search>
          <query>index="oneshot" search |head 1 | eval teste=$show_html$ | eval gethim=$asas$ | table GrupoNome2,gethim</query>
        </search>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>asasasas</title>
      <html>
        <center>teste - $asas$</center>
      </html>
    </panel>
  </row>
</dashboard>
Highlighted

Re: Why am I unable to populate a token with the result of a search with my current Simple XML?

SplunkTrust
SplunkTrust

Replace this

 <set token="asas">results.sourcetype</set>

with

 <set token="asas">$result.sourcetype$</set>

View solution in original post

Highlighted

Re: Why am I unable to populate a token with the result of a search with my current Simple XML?

Path Finder

Hello there @somesoni2, I did it but it didn't work either.
I was searching and I think that I will need version 6.3+ for this to work. Do you know if I'm right? :x

0 Karma
Highlighted

Re: Why am I unable to populate a token with the result of a search with my current Simple XML?

SplunkTrust
SplunkTrust

Thats correct. The option finalized for search is only available for 6.3.x version.

0 Karma
Highlighted

Re: Why am I unable to populate a token with the result of a search with my current Simple XML?

Engager

Hi @somesoni2, can u pls help me on my question above...

0 Karma
Highlighted

Re: Why am I unable to populate a token with the result of a search with my current Simple XML?

Engager

Hi,
I have a similar problem, my token $URL$ is not being set with values..the same query is working fine in another dashboard...My Splunk version 6.5.2

<query>index=MyIndex sourcetype=MySourceType  
| eval URLink = case(ENV=="PROD", "zzz.yy.xx", 1=1, "zzz-".ENV.".yy.xxx") | head 1 | table ENV URLink</query>
<earliest>$time_range.earliest$</earliest>
<latest>$time_range.latest$</latest>
<!--<done>
  <set token="Env">$result.ENV$</set>
  <set token="URLink">$result.URLink$</set>
</done> -->
 <finalized>
    <condition>
      <set token="URL">$result.URLink$</set>
    </condition>
 </finalized>
0 Karma
Highlighted

Re: Why am I unable to populate a token with the result of a search with my current Simple XML?

SplunkTrust
SplunkTrust

The event handler have been updated in Splunk 6.5.x, see this for updated list of event handlers available. http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/EventHandlerReference#Search_event_handlers

0 Karma