Dashboards & Visualizations

How to pass a JS variable to a search in simple XML?

mluktuke
New Member

Hi,

I have a Simple XML dashboard and I call a JS using the script parameter. What I want to do is:

I execute 1 search, get a value and then that value I need to pass it to another search in the JS. Below are the search queries:

search1:

|makeresults | eval earliest="1497218400"|eval From=if(isint(earliest),earliest,relative_time(now(),earliest))| eval From=strftime(From,"%Y/%m/%d")
| eval latest="1497564000"|eval latest=if(latest="now","@m",latest)|eval To=if(isint(latest),latest,relative_time(now(),latest))| eval To=strftime(To,"%Y/%m/%d")| strcat From "-" To DateRange | table DateRange

Runs on the UI. I fetch the results as below:

var searchobject = splunkjs.mvc.Components.getInstance("base");
var results = searchobject.data("results");

    results.on("data",function(){
            var value= results.data().rows[0];
    });

I have another search (this is in JS):
var mysearch2 = new SearchManager({
id: "mysearch2",
autostart: false,
search: mvc.tokenSafe("|inputlookup Approval.csv|search date=\"$value$\""),
cache: false
});

mysearch2.startSearch();

I want to pass $value$ here from the output of previous search.

Is it possible?

Thanks,
Meenal

0 Karma

niketn
Legend

@mluktuke, based on the code snippet and scenario described you do not require JS at all, since the same can be done directly in SimpleXML. Following is your code where first search is generating token tok_DateRange to be passed on to second search which perform inputlookup | inputlookup Approval.csv where date="$tok_DateRange$".

Token tok_DateRange has been set using Search EventHandler <done> which can access search result field/s using field name provided the search returns only one row (or else it picks up only the first row value/s). PS: done search event handler is available from from 6.5 onward, prior to which it was finalized.

  <search>
    <query>| makeresults 
| eval earliest="1497218400"
| eval From=if(isint(earliest),earliest,relative_time(now(),earliest))
| eval From=strftime(From,"%Y/%m/%d")
| eval latest="1497564000"
| eval latest=if(latest="now","@m",latest)
| eval To=if(isint(latest),latest,relative_time(now(),latest))
| eval To=strftime(To,"%Y/%m/%d")
| strcat From "-" To DateRange 
| table DateRange</query>
    <done>
      <set token="tok_DateRange">$result.DateRange$</set>
    </done>
  </search>
  <row>
    <panel>
      <title>tok_DateRange: $tok_DateRange$</title>
      <table>
        <search>
          <query>| inputlookup Approval.csv where date="$tok_DateRange$"
          </query>
        </search>
      </table>
    </panel>
  </row>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

mluktuke
New Member

Thanks @niketnilay, but I am doing all this on click of Submit button. So, JS is needed. If it was just display on another panel, I know it is fairly straightforward in simple XML directly.

0 Karma

niketn
Legend

On click of the button, you can code tokens.set. Depending on your scenario token can be part of either default or submitted token model. Please use accordingly.

// Change the value of a token $mytoken$
tokens.set("mytoken", "this is the new value");

Refer to Splunk Dev site for details: http://dev.splunk.com/view/SP-CAAAEW3

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sbbadri
Motivator

var tokens = mvc.Components.getInstance('submitted');

results.on("data",function(){
var value= results.data().rows[0];
tokens.set('value', value)
});

i think you are missing "manager-id" on mysearch2

var mysearch2 = new SearchManager({
id: "mysearch2",
managerid: "mysearch1",
autostart: false,
search: mvc.tokenSafe("|inputlookup Approval.csv|search date=\"$value$\""),
cache: false
});

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...