Hi All,
Has anybody tried to use the New Search Results setter in 6.3? I am trying to pass the search field results on a token however it is not working. Based on the splunk docs, just use $result.[fieldname]$. Below is my sample xml code.
<dashboard>
<label>Search Result Setter</label>
<description>Set tokens from the search manager to embed throughout the page.</description>
<row>
<panel>
<title>Test</title>
<table>
<title>First sourcetype ($first_sourcetype$)</title>
<search>
<query>index=_internal | top sourcetype</query>
<earliest>-60m</earliest>
<latest>now</latest>
<progress>
<set token="first_sourcetype">$result.sourcetype$</set>
</progress>
<cancelled>
<unset token="first_sourcetype"></unset>
</cancelled>
</search>
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
</table>
</panel>
</row>
</dashboard>
Thanks,
Please refer to the http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML - there is no cancelled tag there. Check the below code, which sets the token as the search finalizes (finalized).
<dashboard>
<label>Search Result Setter</label>
<description>Set tokens from the search manager to embed throughout the page.</description>
<row>
<panel>
<title>Test</title>
<table>
<title>First sourcetype ($first_sourcetype$)</title>
<search>
<query>index=_internal | top sourcetype</query>
<earliest>-60m</earliest>
<latest>now</latest>
<progress>
<set token="first_sourcetype">$result.sourcetype$</set>
</progress>
<finalized>
<set token="first_sourcetype">$result.sourcetype$</set>
</finalized>
</search>
<option name="charting.chart">bar</option>
<option name="charting.legend.placement">none</option>
<option name="wrap">true</option>
<option name="rowNumbers">false</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="count">10</option>
</table>
</panel>
</row>
</dashboard>
Hi PiUek,
Can we refer to all the the rows in the search results instead of only a first row ??
is this is possible in Splunk ??
thanks,
Rakesh.