can we run a search using the Splunk API to get back a single result(not streaming) without using a saved search or SID? I tried export like below which is giving streamed output, i want single result curl -k -u admin:admin https://searchhead:8089/services/search/jobs/export -d search="search *| stats max(_time) AS _time BY "pctIdle" | head 1|sort 0 - _time | rename "pctIdle" AS Value" -d output_mode=json I tried post like this , giving me SID( i dont wnt to use SID r saved search ) curl -k -u admin:admin https://searchhead:8089/servicesNS/admin/search/search/jobs --data-urlencode search="search * | stats max(_time) AS _time BY "pctIdle" | sort 0 - _time | head 1|rename "pctIdle" AS Value " -d id=mysearch_0215194643 -d max_count=50000 -d status_buckets=300 Any other way to get results with out SID r saved search? ... View more

Hi all , My requirement is to have a dashboard for bulk alarm enable /disable. means I can select multiple alarms and click a button which will disable/enable the alarms. for that to have check boxes in table i used "https://answers.splunk.com/answers/587089/multiselect-table-rows.html " and created a dashboard like this Now I need a checkbox which will select all other check boxes. I want to have that checkbox in table header in third column that is in place of "checkbox" in my picture. Also I would like to refresh page when submit button is clicked , so that user will understand that action completed.. Can some one please help me to achieve this. my.js require([ 'underscore', 'jquery', 'splunkjs/mvc', 'splunkjs/mvc/tableview', 'splunkjs/mvc/simplexml/ready!' ], function(_, $, mvc, TableView) { var tokens = mvc.Components.get("default"); var selected_values_array = []; var submittedTokens = mvc.Components.get('submitted'); var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return _(['checkbox']).contains(cell.field); }, render: function($th, cell) { var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass('checkbox').click(function() { if($(this).attr('class')==="checkbox") { selected_values_array.push($(this).attr('value')); $(this).removeClass(); $(this).addClass("checkbox checked"); } else { $(this).removeClass(); $(this).addClass("checkbox"); var i = selected_values_array.indexOf($(this).attr('value')); if(i != -1) { selected_values_array.splice(i, 1); } } console.log(selected_values_array); }).appendTo($th); } }); var CustomRangeRenderer = TableView.BaseCellRenderer.extend({ canRender: function(cell) { return _(['checkbox']).contains(cell.field); }, render: function($td, cell) { var a = $('<div>').attr({"id":"chk-sourcetype"+cell.value,"value":cell.value}).addClass('checkbox').click(function() { if($(this).attr('class')==="checkbox") { selected_values_array.push($(this).attr('value')); $(this).removeClass(); $(this).addClass("checkbox checked"); } else { $(this).removeClass(); $(this).addClass("checkbox"); var i = selected_values_array.indexOf($(this).attr('value')); if(i != -1) { selected_values_array.splice(i, 1); } } console.log(selected_values_array); }).appendTo($td); } }); var tableIDs = ["myTable"]; for (i=0;i<tableIDs.length;i++) { var sh = mvc.Components.get(tableIDs[i]); if(typeof(sh)!="undefined") { sh.getVisualization(function(tableView) { tableView.table.addCellRenderer(new CustomRangeRenderer()); tableView.table.render(); }); } } ; $(document).ready(function () { $("#mybutton").on("click", function (e) { e.preventDefault(); console.log("in"); tokens.set("mytoken", selected_values_array.join()); submittedTokens.set(tokens.toJSON()); console.log("refresh"); }); }); }); mydashboard.xml <form script="my.js" stylesheet="my.css"> <fieldset submitButton="false" autoRun="true"> <input type="text" token="filter1"> <label>label</label> <default></default> </input> </fieldset> <row> <panel> <table id="myTable"> <title>My Table</title> <search id="mysearch1"> <query>|rest /servicesNS/-/-/saved/searches |rename eai:acl.app as app|where app="asp" and title like "%$filter1$%"|dedup title|rename disabled as Enabled|replace 0 with Yes , 1 with No in Enabled|rename title as sourcetype|table sourcetype,Enabled| eval checkbox=sourcetype</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">row</option> <drilldown> <condition field="*"></condition> </drilldown> </table> </panel> </row> <row> <html> <div> <input type="button" id="mybutton" value="My Button" /> </div> </html> </row> <row> <panel> <table> <title>My Selected Value</title> <search id="mysearch"> <query>|enablecustom enable "$mytoken$"</query> <earliest>-15m</earliest> <latest>now</latest> </search> <option name="count">10</option> <option name="drilldown">none</option> </table> </panel> </row> </form> Please help me. Thanks in advance. ... View more