Reporting

How to dispatch a saved search with parameters using the Javascript SDK

yoxigen
Engager

If I dispatch a saved search with no parameters (like $IP$, $HOST$, $username$, etc), it runs properly and returns result, but for some reason when dispatching a search with parameters, I get no rows in the result.

Here's how I'm sending the search with params:

mySavedSearch.dispatch({ "dispatch.IP": "192.168.0.1" }, function(err, job) { ... }

I got this from the SavedSearch documentation:
http://docs.splunk.com/DocumentationStatic/JavaScriptSDK/1.1/splunkjs.Service.SavedSearch.html#splun...

Can anyone advise me how to run a saved search with the Javascript SDK, with parameters?

Thanks!
Yossi.

0 Karma
1 Solution

Neeraj_Luthra
Splunk Employee
Splunk Employee

There are a few dispatch specific arguments you can pass like bucket, max_count, earliest_time etc. You can get the full list at savedsearches.conf.

The parameters that you are trying to use are substituted slightly differently. Here is an example ...

Sample saved search query with host as one of the parameters that I want to substitute at runtime:

index=fooindex sourcetype=foosourcetype host=$args.host$

Sample JS code to dispatch with argument substitution:
mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) {

You can bind multiple parameters in the call above depending on your need. Remember to specify args along with your parameter name as mentioned above.

View solution in original post

Neeraj_Luthra
Splunk Employee
Splunk Employee

There are a few dispatch specific arguments you can pass like bucket, max_count, earliest_time etc. You can get the full list at savedsearches.conf.

The parameters that you are trying to use are substituted slightly differently. Here is an example ...

Sample saved search query with host as one of the parameters that I want to substitute at runtime:

index=fooindex sourcetype=foosourcetype host=$args.host$

Sample JS code to dispatch with argument substitution:
mySavedSearch.dispatch({"args.host": "foohost"}, function(err, job) {

You can bind multiple parameters in the call above depending on your need. Remember to specify args along with your parameter name as mentioned above.

Neeraj_Luthra
Splunk Employee
Splunk Employee

Agreed. We have this documented for our Java and C# SDKs but we need to port this information into other SDKs as well.

0 Karma

yoxigen
Engager

Thanks Neeraj, this really helps!

In the Javasript SDK documentation it doesn't say anything about having to specify the saved search parameters as "$args.host" instead of "$host", but that's what I was missing.

It'd be great for others looking for the same information if an example was added to the Javascript SDK API reference under SavedSearch.dispatch.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...