<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Drop down with Saved Search does not respond to time token change and Submit button present in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-down-with-Saved-Search-does-not-respond-to-time-token/m-p/369538#M24155</link>
    <description>&lt;P&gt;Dear All&lt;/P&gt;

&lt;P&gt;I have a Drop Down (named Database) which loads list of options dynamically via a search initially started in a saved-search, saved top of the form. The form has also a time token input and a Submit button. The saved search is bound to the time token (see code below)&lt;BR /&gt;
The problem is that when I change the time in the time token - the Drop-Down list of values is not refreshed. &lt;/P&gt;

&lt;P&gt;Please see the code below, start of the form to Submit button:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;Scan Compare 001&amp;lt;/label&amp;gt;

  &amp;lt;!-- This limits events passed to post-process search --&amp;gt;
  &amp;lt;search id="vln_base"&amp;gt;
    &amp;lt;query&amp;gt;
      `mc_vln`
    &amp;lt;/query&amp;gt;
    &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
  &amp;lt;/search&amp;gt;

  &amp;lt;search id="vln_cmp"&amp;gt;
    &amp;lt;query&amp;gt;`mc_comp($field_scan_run_id$,$field_scan_bs_id$)`&amp;lt;/query&amp;gt;
    &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
  &amp;lt;/search&amp;gt;

  &amp;lt;fieldset submitButton="true" autoRun="false"&amp;gt;
    &amp;lt;input type="time" token="field1" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Time&amp;lt;/label&amp;gt;
      &amp;lt;default&amp;gt;
        &amp;lt;earliest&amp;gt;-30d@d&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/default&amp;gt;
    &amp;lt;/input&amp;gt;

    &amp;lt;input type="dropdown" token="field_db_name" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Database&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;DB_NAME&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;DB_NAME&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;DEDUP DB_NAME | FIELDS DB_NAME&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="db_name_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="dropdown" token="field_scan_run_id" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Scan Id Run&amp;lt;/label&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID
| sort - SCAN_DT_START&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;SCAN_ID&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;SCAN_ID&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="scan_run_id_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="dropdown" token="field_scan_bs_id" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Scan Id Baseline&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;SCAN_ID&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;SCAN_ID&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="scan_bs_id_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;
          &amp;lt;![CDATA[          
          search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID 
| sort - SCAN_DT_START 
]]&amp;gt;
        &amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="dropdown" token="field_cmp_code" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Comparison&amp;lt;/label&amp;gt;
      &amp;lt;showClearButton&amp;gt;false&amp;lt;/showClearButton&amp;gt;
      &amp;lt;choice value="ALL_NO_FIELD_ALL"&amp;gt;ALL&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="Unchanged"&amp;gt;Changes Only&amp;lt;/choice&amp;gt;
      &amp;lt;selectFirstChoice&amp;gt;true&amp;lt;/selectFirstChoice&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;.......................................................................................................&lt;/P&gt;

&lt;P&gt;If I renounce using a saved search in the Database drop down, and use a direct search  (see code below)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="field_db_name" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Database&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;DB_NAME&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;DB_NAME&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;DEDUP DB_NAME | FIELDS DB_NAME&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="db_name_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;replaced  with&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="field_db_name" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Database&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;DB_NAME&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;DB_NAME&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME&amp;lt;/query&amp;gt;
        &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="db_name_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;then the Database Drop Down starts responding to changes in token, it reloads the options list each time the time is changed.&lt;/P&gt;

&lt;P&gt;Back into the problematic case with saved search - I can have the Database Drop Down reloaded by pressing the Submit button. But I need to have it respond to the Time Picker (token) - the Submit button is needed for later (in form) dashboards.&lt;/P&gt;

&lt;P&gt;My question: &lt;BR /&gt;
Q1.  Why the options list search direct VS / saved-search makes a difference on this?&lt;BR /&gt;
Q2. How can I have this problem fixed by using saved-search in the Drop-Down?&lt;/P&gt;

&lt;P&gt;best regards,&lt;BR /&gt;
Altin&lt;/P&gt;

&lt;P&gt;at your disposal for further info/query&lt;/P&gt;</description>
    <pubDate>Fri, 27 Apr 2018 19:53:22 GMT</pubDate>
    <dc:creator>altink</dc:creator>
    <dc:date>2018-04-27T19:53:22Z</dc:date>
    <item>
      <title>Drop down with Saved Search does not respond to time token change and Submit button present</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-down-with-Saved-Search-does-not-respond-to-time-token/m-p/369538#M24155</link>
      <description>&lt;P&gt;Dear All&lt;/P&gt;

&lt;P&gt;I have a Drop Down (named Database) which loads list of options dynamically via a search initially started in a saved-search, saved top of the form. The form has also a time token input and a Submit button. The saved search is bound to the time token (see code below)&lt;BR /&gt;
The problem is that when I change the time in the time token - the Drop-Down list of values is not refreshed. &lt;/P&gt;

&lt;P&gt;Please see the code below, start of the form to Submit button:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;form&amp;gt;
  &amp;lt;label&amp;gt;Scan Compare 001&amp;lt;/label&amp;gt;

  &amp;lt;!-- This limits events passed to post-process search --&amp;gt;
  &amp;lt;search id="vln_base"&amp;gt;
    &amp;lt;query&amp;gt;
      `mc_vln`
    &amp;lt;/query&amp;gt;
    &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
  &amp;lt;/search&amp;gt;

  &amp;lt;search id="vln_cmp"&amp;gt;
    &amp;lt;query&amp;gt;`mc_comp($field_scan_run_id$,$field_scan_bs_id$)`&amp;lt;/query&amp;gt;
    &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
  &amp;lt;/search&amp;gt;

  &amp;lt;fieldset submitButton="true" autoRun="false"&amp;gt;
    &amp;lt;input type="time" token="field1" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Time&amp;lt;/label&amp;gt;
      &amp;lt;default&amp;gt;
        &amp;lt;earliest&amp;gt;-30d@d&amp;lt;/earliest&amp;gt;
        &amp;lt;latest&amp;gt;now&amp;lt;/latest&amp;gt;
      &amp;lt;/default&amp;gt;
    &amp;lt;/input&amp;gt;

    &amp;lt;input type="dropdown" token="field_db_name" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Database&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;DB_NAME&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;DB_NAME&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;DEDUP DB_NAME | FIELDS DB_NAME&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="db_name_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="dropdown" token="field_scan_run_id" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Scan Id Run&amp;lt;/label&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID
| sort - SCAN_DT_START&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;SCAN_ID&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;SCAN_ID&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="scan_run_id_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="dropdown" token="field_scan_bs_id" searchWhenChanged="false"&amp;gt;
      &amp;lt;label&amp;gt;Scan Id Baseline&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;SCAN_ID&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;SCAN_ID&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="scan_bs_id_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;
          &amp;lt;![CDATA[          
          search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID 
| sort - SCAN_DT_START 
]]&amp;gt;
        &amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
    &amp;lt;input type="dropdown" token="field_cmp_code" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Comparison&amp;lt;/label&amp;gt;
      &amp;lt;showClearButton&amp;gt;false&amp;lt;/showClearButton&amp;gt;
      &amp;lt;choice value="ALL_NO_FIELD_ALL"&amp;gt;ALL&amp;lt;/choice&amp;gt;
      &amp;lt;choice value="Unchanged"&amp;gt;Changes Only&amp;lt;/choice&amp;gt;
      &amp;lt;selectFirstChoice&amp;gt;true&amp;lt;/selectFirstChoice&amp;gt;
    &amp;lt;/input&amp;gt;
  &amp;lt;/fieldset&amp;gt;
  &amp;lt;row&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;.......................................................................................................&lt;/P&gt;

&lt;P&gt;If I renounce using a saved search in the Database drop down, and use a direct search  (see code below)&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="field_db_name" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Database&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;DB_NAME&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;DB_NAME&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search base="vln_base"&amp;gt;
        &amp;lt;query&amp;gt;DEDUP DB_NAME | FIELDS DB_NAME&amp;lt;/query&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="db_name_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;replaced  with&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="dropdown" token="field_db_name" searchWhenChanged="true"&amp;gt;
      &amp;lt;label&amp;gt;Database&amp;lt;/label&amp;gt;
      &amp;lt;fieldForLabel&amp;gt;DB_NAME&amp;lt;/fieldForLabel&amp;gt;
      &amp;lt;fieldForValue&amp;gt;DB_NAME&amp;lt;/fieldForValue&amp;gt;
      &amp;lt;search&amp;gt;
        &amp;lt;query&amp;gt;index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME&amp;lt;/query&amp;gt;
        &amp;lt;earliest&amp;gt;$field1.earliest$&amp;lt;/earliest&amp;gt;
    &amp;lt;latest&amp;gt;$field1.latest$&amp;lt;/latest&amp;gt;
      &amp;lt;/search&amp;gt;
      &amp;lt;change&amp;gt;
        &amp;lt;set token="db_name_no_quotes"&amp;gt;$value$&amp;lt;/set&amp;gt;
      &amp;lt;/change&amp;gt;
      &amp;lt;prefix&amp;gt;"&amp;lt;/prefix&amp;gt;
      &amp;lt;suffix&amp;gt;"&amp;lt;/suffix&amp;gt;
    &amp;lt;/input&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;then the Database Drop Down starts responding to changes in token, it reloads the options list each time the time is changed.&lt;/P&gt;

&lt;P&gt;Back into the problematic case with saved search - I can have the Database Drop Down reloaded by pressing the Submit button. But I need to have it respond to the Time Picker (token) - the Submit button is needed for later (in form) dashboards.&lt;/P&gt;

&lt;P&gt;My question: &lt;BR /&gt;
Q1.  Why the options list search direct VS / saved-search makes a difference on this?&lt;BR /&gt;
Q2. How can I have this problem fixed by using saved-search in the Drop-Down?&lt;/P&gt;

&lt;P&gt;best regards,&lt;BR /&gt;
Altin&lt;/P&gt;

&lt;P&gt;at your disposal for further info/query&lt;/P&gt;</description>
      <pubDate>Fri, 27 Apr 2018 19:53:22 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-down-with-Saved-Search-does-not-respond-to-time-token/m-p/369538#M24155</guid>
      <dc:creator>altink</dc:creator>
      <dc:date>2018-04-27T19:53:22Z</dc:date>
    </item>
    <item>
      <title>Re: Drop down with Saved Search does not respond to time token change and Submit button present</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-down-with-Saved-Search-does-not-respond-to-time-token/m-p/369539#M24156</link>
      <description>&lt;P&gt;resolved by enabling Search on Change on the Time component&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;&amp;lt;input type="time" token="field1" searchWhenChanged="true"&amp;gt;
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Sun, 29 Apr 2018 20:28:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/Drop-down-with-Saved-Search-does-not-respond-to-time-token/m-p/369539#M24156</guid>
      <dc:creator>altink</dc:creator>
      <dc:date>2018-04-29T20:28:11Z</dc:date>
    </item>
  </channel>
</rss>

