Hello all.
I am making a dashboard in which I was in the need to create a subsearch. This is the piece of code that does it:
<panel> <title>random panel title</title> <table depends="$show_debug$"> <search id="Build_list"> <query>index= here it goes my query |fields * |table important_field |format</query> <finalized> <condition match=" 'job.resultCount' != 0"> <set token="my_list">$result.search$</set> </condition> <condition> <unset token="my_list"></unset> </condition> </finalized> </search> <option name="drilldown">none</option> </table> </panel> </row> <row> <panel> <title>another panel</title> <html depends="$show_debug$"> <h3>$my_list$</h3> </html> </panel>
and here I am using the $my_list$ token:
<search> <query>$my_list$ | foreach something.* [rename "<<FIELD>>" as "<<MATCHSEG1>>"] | stats values(Url),values(UrlDomain)</query> <earliest>$earliest$</earliest> <latest>$latest$</latest> </search>
This worked well the first time, but now, for every new query I do, no matter if I close and open a new browser/splunk session, I see still the results of the first query I did. is like $my_list$ has the first ever values hardened and I cannot reset them. I though that <unset token="my_list"></unset> would clear it but not....
Any help please? The goal here is to use this $my_list$ token, which is a splunk query (note the |format at the end of the query) but of course this token needs to be empty every time I run a new query.
Thanks a lot in advance.
Mario
... View more
