I want to set the title of one of my dashboards after the search is complete. I have tried using various event handlers but can't get the token to set. What am I missing?
<search base="myBaseSearch">
<query> | search foo</query>
<done>
<condition match=" 'job.isDone' == true">
<set token="col1_token">$result.col1$</set>
</condition>
</done>
</search>
You should not need the condition since the done event handler fires when the job is, well, done...
Here is an example:
<form>
<label>Start a search after another search finishes</label>
<description>This dashboard demonstrates how to start a second search after a primary search finishes. This is accomplished by using the <done> event handler in the <search> element.</description>
<fieldset submitButton="true" autoRun="false">
<input type="time" token="field1">
<label></label>
<default>
<earliest>-48h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<title>Primary Search</title>
<table>
<search>
<query>index=_internal sourcetype=splunkd | table host source sourcetype</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
<done>
<set token="start">$job.earliestTime$</set>
<set token="end">$job.latestTime$</set>
</done>
</search>
<option name="count">5</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
<row>
<panel>
<title>This search happens after the above search is finished</title>
<chart>
<search>
<query>index=_internal | timechart count as total count(eval(sourcetype="splunkd")) as "splunkd"</query>
<earliest>$start$</earliest>
<latest>$end$</latest>
</search>
<option name="charting.axisTitleX.visibility">collapsed</option>
<option name="charting.axisTitleY.visibility">collapsed</option>
<option name="charting.axisTitleY2.visibility">visible</option>
<option name="charting.axisX.scale">linear</option>
<option name="charting.axisY.scale">linear</option>
<option name="charting.axisY2.enabled">1</option>
<option name="charting.axisY2.fields">splunkd</option>
<option name="charting.axisY2.scale">inherit</option>
<option name="charting.chart">column</option>
<option name="charting.chart.overlayFields">splunkd</option>
<option name="charting.fieldColors">{"total": 0x639BF1, "splunkd":0xFF5A09}</option>
<option name="charting.legend.masterLegend">null</option>
<option name="charting.legend.placement">bottom</option>
<option name="height">300</option>
</chart>
</panel>
</row>
</form>
So I have a default value for col1
that is "Pending completion of search". What I wanted was for col1
to input its value once the query is complete (using a base search). I want it to keep the "Pending completion of search" until the search is actually done. For some reason, my dashboard displays
This dashboard is Pending completion of search (1second)
..
changes to
..
This dashboard is $result.col1$"
..
query finishes 10 seconds later
..
This dashboard is Acceptable
It would be helpful to post your dashboard's XML.