topic Re: Why doesn't the pulldown work the first time I select a value (with a trivial Example!)? in Splunk Dev

Why doesn't the pulldown work the first time I select a value (with a trivial Example!)?

ifeldshteyn — Tue, 29 Jan 2019 00:10:55 GMT

Hello,

I have a really simple dashboard with a single pulldown. I notice that it never seems to take effect the first time I select a value — only the second time.

Here is the code with a base search and a simple table panel over the past hour. If I load this in Splunk (6.5.2) and run it, I will see the dropdown populated. If I choose one source type, it will immediately update the pulldown options but NOT update the table results. If I reset and chose another source type, it then takes effect. Hypothesis: this is because of a base search and filtering search for the dropdowns? I'd like for it to work the first time without requiring a Submit button. Note: I tried setting the option searchWhenChanged - but it didn't help. (searchWhenChanged="true")

<form>
  <label>test</label>
  <search id="base">
    <query>index =_internal earliest=-1h| fields sourcetype</query>
  </search>
  <fieldset submitButton="false">
    <input type="dropdown" token="sourcetype">
      <label>Sourcetypes</label>
      <choice value="*">All SourceTypes</choice>
      <default>*</default>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
      <search base="base">
        <query>search sourcetype="*$sourcetype$*" | dedup sourcetype | sort sourcetype</query>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="base">
          <query>search sourcetype="*$sourcetype$*" | head </query>
        </search>
      </table>
    </panel>
  </row>
</form>

Re: Why doesn't the pulldown work the first time I select a value (with a trivial Example!)?

chrisyounger — Tue, 29 Jan 2019 00:22:18 GMT

Hi @ifeldshteyn

I just tested this dashboard in my 7.1 Splunk instance and it works perfect - it always updates the raw results and the table. However I do find it unusal that you are using a token to update the search of the input that sets the token.

I made a few minor updates to your dashboard that you could try:

<form>
   <label>test</label>
   <search id="base">
     <!-- You should specify all fields that you plan to use later -->
     <query>index =_internal earliest=-1h| fields sourcetype _raw _time</query>
   </search>
   <fieldset submitButton="false">
     <input type="dropdown" token="sourcetype">
       <label>Sourcetypes</label>
       <choice value="*">All SourceTypes</choice>
       <default>*</default>
       <fieldForLabel>sourcetype</fieldForLabel>
       <fieldForValue>sourcetype</fieldForValue>
       <search base="base">
         <!-- Remove filter on sourcetype -->
         <query>dedup sourcetype | sort sourcetype</query>
       </search>
     </input>
   </fieldset>
   <row>
     <panel>
       <table>
         <search base="base">
           <!-- Use the $|s$ quoting when using tokens -->
           <query>search sourcetype=$sourcetype|s$ | head </query>
         </search>
       </table>
     </panel>
   </row>
 </form>

Re: Why doesn't the pulldown work the first time I select a value (with a trivial Example!)?

ifeldshteyn — Tue, 29 Jan 2019 17:36:30 GMT

Hi, I know I can get this to work, but then, if I add additional pulldowns, they are not filtered. Here is an example with additional pulldown of Source. If I filter a sourcetype, the source pulldown is not filtered and vice versa. In effect, I want, upon a pulldown selection to fillter the options in other pulldowns AND the downstream data. And I can get it to work only if I select something twice, or use a submit button which I was hoping to avoid.

<input type="dropdown" token="sourcetype" searchWhenChanged="true">
  <label>Sourcetypes</label>
  <choice value="*">All SourceTypes</choice>
  <default>*</default>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
  <search base="base">
    <query>dedup sourcetype | sort sourcetype</query>
  </search>
</input>
    <input type="dropdown" token="source" searchWhenChanged="true">
  <label>Sourcetypes</label>
  <choice value="*">All Source</choice>
  <default>*</default>
  <fieldForLabel>source</fieldForLabel>
  <fieldForValue>source</fieldForValue>
  <search base="base">
    <query>dedup source | sort source</query>
  </search>
</input>


<panel>
  <table>
    <search base="base">
      <query>search sourcetype="*$sourcetype$*" source = "*$source$*"| head</query>
    </search>
  </table>
</panel>