Hi All,
Has anybody tried to use the New Search Results setter in 6.3? I am trying to pass the search field results on a token however it is not working. Based on the splunk docs, just use $result.[fieldname]$. Below is my sample xml code.
<dashboard>
<label>Search Result Setter</label>
<description>Set tokens from the search manager to embed throughout the page.</description>
<row>
<panel>
<title>Test</title>
<table>
<title>First sourcetype ($first_sourcetype$)</title>
<search>
<query>index=_internal | top sourcetype</query>
<earliest>-60m</earliest>
<latest>now</latest>
<progress>
<set token="first_sourcetype">$result.sourcetype$</set>
</progress>
<cancelled>
<unset token="first_sourcetype"></unset>
</cancelled>
</search>
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</dashboard>
Thanks,
... View more