Dashboards & Visualizations

Pass token to oneshotSearch

komalg
New Member

Hi,

Inside my dashboard I am executing a oneshotSearch in my html dashboard using javascript. How do I pass tokens to this search?

service2.oneshotSearch(
  searchQuery,
  searchParams,
  function(err, results) {
    // Display the results....}

var searchQuery = "...\"$form.Application$\" ";

I tried the above syntax and it does not work. It has to be a html dashboard.

Thanks.

0 Karma

paramagurukarth
Builder

You can get the token value in you custom module and for your query..
Read this doc.. this got all you want..
You can even attach on-change events to a token object and change your query correspondingly

http://dev.splunk.com/view/SP-CAAAE25#Addingcode:usingJavaScriptandSearchProcessingLanguage-Workingw...

Also https://www.youtube.com/watch?v=lojUc9v37Jg&list=PL7zWAA-DF0k9U_s1w5EY33o2JqJgdHRGz&index=2

0 Karma

komalg
New Member

I have the token by doing the tokens.get call and the token has the value also.
I need the way to pass this token to the query in the oneshot search. I am sure there is way, could not find it right syntax for it.

Thanks.

0 Karma

paramagurukarth
Builder

instead of this,
var searchQuery = "...\"$form.Application$\" ";

try

var defaultTokens = mvc.Components.get("default"); 
var submittedTokens = mvc.Components.get("submitted"); 
var tokens = {
    get: function(tokenName) {
        return defaultTokens.get(tokenName);
    },

    set: function(tokenName, tokenValue) {
        defaultTokens.set(tokenName, tokenValue);
        submittedTokens.set(tokenName, tokenValue);
    }, 
    on: function(eventName, callback) { 
        defaultTokens.on(eventName, callback); 
    }
};
var searchQuery = "..."  + (tokens.get("Application") || tokens.get("form.Application")) + "... ";
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...