Hi,
I have a Simple XML dashboard and I call a JS using the script parameter. What I want to do is:
I execute 1 search, get a value and then that value I need to pass it to another search in the JS. Below are the search queries:
search1:
|makeresults | eval earliest="1497218400"|eval From=if(isint(earliest),earliest,relative_time(now(),earliest))| eval From=strftime(From,"%Y/%m/%d")
| eval latest="1497564000"|eval latest=if(latest="now","@m",latest)|eval To=if(isint(latest),latest,relative_time(now(),latest))| eval To=strftime(To,"%Y/%m/%d")| strcat From "-" To DateRange | table DateRange
Runs on the UI. I fetch the results as below:
var searchobject = splunkjs.mvc.Components.getInstance("base");
var results = searchobject.data("results");
results.on("data",function(){
var value= results.data().rows[0];
});
I have another search (this is in JS):
var mysearch2 = new SearchManager({
id: "mysearch2",
autostart: false,
search: mvc.tokenSafe("|inputlookup Approval.csv|search date=\"$value$\""),
cache: false
});
mysearch2.startSearch();
I want to pass $value$ here from the output of previous search.
Is it possible?
Thanks,
Meenal
@mluktuke, based on the code snippet and scenario described you do not require JS at all, since the same can be done directly in SimpleXML. Following is your code where first search is generating token tok_DateRange
to be passed on to second search which perform inputlookup | inputlookup Approval.csv where date="$tok_DateRange$"
.
Token tok_DateRange has been set using Search EventHandler <done>
which can access search result field/s using field name provided the search returns only one row (or else it picks up only the first row value/s). PS: done search event handler is available from from 6.5 onward, prior to which it was finalized.
<search>
<query>| makeresults
| eval earliest="1497218400"
| eval From=if(isint(earliest),earliest,relative_time(now(),earliest))
| eval From=strftime(From,"%Y/%m/%d")
| eval latest="1497564000"
| eval latest=if(latest="now","@m",latest)
| eval To=if(isint(latest),latest,relative_time(now(),latest))
| eval To=strftime(To,"%Y/%m/%d")
| strcat From "-" To DateRange
| table DateRange</query>
<done>
<set token="tok_DateRange">$result.DateRange$</set>
</done>
</search>
<row>
<panel>
<title>tok_DateRange: $tok_DateRange$</title>
<table>
<search>
<query>| inputlookup Approval.csv where date="$tok_DateRange$"
</query>
</search>
</table>
</panel>
</row>
Thanks @niketnilay, but I am doing all this on click of Submit button. So, JS is needed. If it was just display on another panel, I know it is fairly straightforward in simple XML directly.
On click of the button, you can code tokens.set
. Depending on your scenario token can be part of either default
or submitted
token model. Please use accordingly.
// Change the value of a token $mytoken$
tokens.set("mytoken", "this is the new value");
Refer to Splunk Dev site for details: http://dev.splunk.com/view/SP-CAAAEW3
var tokens = mvc.Components.getInstance('submitted');
results.on("data",function(){
var value= results.data().rows[0];
tokens.set('value', value)
});
i think you are missing "manager-id" on mysearch2
var mysearch2 = new SearchManager({
id: "mysearch2",
managerid: "mysearch1",
autostart: false,
search: mvc.tokenSafe("|inputlookup Approval.csv|search date=\"$value$\""),
cache: false
});