If I dispatch a saved search with no parameters (like $IP$, $HOST$, $username$, etc), it runs properly and returns result, but for some reason when dispatching a search with parameters, I get no rows in the result.
Here's how I'm sending the search with params:
mySavedSearch.dispatch({ "dispatch.IP": "192.168.0.1" }, function(err, job) { ... }
I got this from the SavedSearch documentation:
http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.1/splunkjs.Service.SavedSearch.html#splun...
Can anyone advise me how to run a saved search with the Javascript SDK, with parameters?
Thanks!
Yossi.
There are a few dispatch specific arguments you can pass like bucket
, max_count
, earliest_time
etc. You can get the full list at savedsearches.conf.
The parameters that you are trying to use are substituted slightly differently. Here is an example ...
Sample saved search query with host
as one of the parameters that I want to substitute at runtime:
index=fooindex sourcetype=foosourcetype host=$args.host$
mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) {
You can bind multiple parameters in the call above depending on your need. Remember to specify args
along with your parameter name as mentioned above.
There are a few dispatch specific arguments you can pass like bucket
, max_count
, earliest_time
etc. You can get the full list at savedsearches.conf.
The parameters that you are trying to use are substituted slightly differently. Here is an example ...
Sample saved search query with host
as one of the parameters that I want to substitute at runtime:
index=fooindex sourcetype=foosourcetype host=$args.host$
mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) {
You can bind multiple parameters in the call above depending on your need. Remember to specify args
along with your parameter name as mentioned above.
Thanks Neeraj, this really helps!
In the Javasript SDK documentation it doesn't say anything about having to specify the saved search parameters as "$args.host" instead of "$host", but that's what I was missing.
It'd be great for others looking for the same information if an example was added to the Javascript SDK API reference under SavedSearch.dispatch.