Dashboards & Visualizations

How to set a token for XML dashboard using an event handler to represent when a search is complete?

kmfpo
Explorer

I want to set the title of one of my dashboards after the search is complete. I have tried using various event handlers but can't get the token to set. What am I missing?

<search base="myBaseSearch">
  <query> | search foo</query>
    <done>
       <condition match=" 'job.isDone' == true">
         <set token="col1_token">$result.col1$</set>
       </condition>
    </done>
</search>
0 Karma

jconger
Splunk Employee
Splunk Employee

You should not need the condition since the done event handler fires when the job is, well, done...

Here is an example:

<form>
  <label>Start a search after another search finishes</label>
  <description>This dashboard demonstrates how to start a second search after a primary search finishes.  This is accomplished by using the &lt;done&gt; event handler in the &lt;search&gt; element.</description>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-48h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Primary Search</title>
      <table>
        <search>
          <query>index=_internal sourcetype=splunkd | table host source sourcetype</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <set token="start">$job.earliestTime$</set>
            <set token="end">$job.latestTime$</set>
          </done>
        </search>
        <option name="count">5</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>This search happens after the above search is finished</title>
      <chart>
        <search>
          <query>index=_internal | timechart count as total count(eval(sourcetype="splunkd")) as "splunkd"</query>
          <earliest>$start$</earliest>
          <latest>$end$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.axisTitleY.visibility">collapsed</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">1</option>
        <option name="charting.axisY2.fields">splunkd</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">splunkd</option>
        <option name="charting.fieldColors">{"total": 0x639BF1, "splunkd":0xFF5A09}</option>
        <option name="charting.legend.masterLegend">null</option>
        <option name="charting.legend.placement">bottom</option>
        <option name="height">300</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

kmfpo
Explorer

So I have a default value for col1 that is "Pending completion of search". What I wanted was for col1 to input its value once the query is complete (using a base search). I want it to keep the "Pending completion of search" until the search is actually done. For some reason, my dashboard displays

This dashboard is Pending completion of search (1second)
..
changes to
..
This dashboard is $result.col1$"
..
query finishes 10 seconds later
..
This dashboard is Acceptable

0 Karma

jconger
Splunk Employee
Splunk Employee

It would be helpful to post your dashboard's XML.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...