Splunk variable substitutions in fieldsets work randomly - race conditions

kbhit — Tue, 12 Feb 2019 12:03:15 GMT

Can anyone come up with an explanation of why sometimes the "source" is correct (eg. my-myapp-qa) but many times its not formatted (my-$service$-qa)?

 <fieldset autoRun="true" submitButton="true">
    <input type="dropdown" token="service" searchWhenChanged="false">
      <label>Service</label>
      <choice value="myapp">myapp</choice>
      <choice value="otherapp">otherapp</choice>
      <default>myapp</default>
      <change>
        <condition value="deals">
          <set token="status_url">/dac/api/healthcheck</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="environment" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="qa">qa</choice>
      <choice value="dev">dev</choice>
      <choice value="ppe">ppe</choice>
      <choice value="prod">prod</choice>
      <default>ppe</default>
      <change>
        <condition value="qa">
          <set token="index">myindex</set>
          <set token="sourcetype">kubernetes-dev</set>
          <set token="source">*my-$service$-qa*</set>
        </condition>
        <condition value="dev">
          <set token="index">myindex</set>
          <set token="sourcetype">kubernetes-dev</set>
          <set token="source">*my-$service$-dev*</set>
        </condition>
      </change>
    </input>
</fieldset>

Re: Splunk variable substitutions in fieldsets work randomly - race conditions

vnravikumar — Tue, 12 Feb 2019 14:13:39 GMT

Hi @kbhit

You are cascading dropdowns, the second one depends on first dropdown. So it is better to reset the second dropdown when you change the first one.

<form>
  <label>demo</label>
  <fieldset autoRun="true" submitButton="true">
    <input type="dropdown" token="service" searchWhenChanged="true">
      <label>Service</label>
      <choice value="myapp">myapp</choice>
      <choice value="otherapp">otherapp</choice>
      <default>myapp</default>
      <change>
        <condition value="deals">
          <set token="status_url">/dac/api/healthcheck</set>
        </condition>
        <condition>
          <unset token="form.environment"></unset>
          <unset token="form.source"></unset>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="environment" searchWhenChanged="true">
      <label>Environment</label>
      <choice value="qa">qa</choice>
      <choice value="dev">dev</choice>
      <choice value="ppe">ppe</choice>
      <choice value="prod">prod</choice>
      <default>ppe</default>
      <change>
        <condition value="qa">
          <set token="index">myindex</set>
          <set token="sourcetype">kubernetes-dev</set>
          <set token="form.source">*my-$service$-qa*</set>
        </condition>
        <condition value="dev">
          <set token="index">myindex</set>
          <set token="sourcetype">kubernetes-dev</set>
          <set token="form.source">*my-$service$-dev*</set>
        </condition>
      </change>
    </input>
    <input type="text" token="source">Source</input>
  </fieldset>
</form>

topic Re: Splunk variable substitutions in fieldsets work randomly - race conditions in Dashboards & Visualizations

Splunk variable substitutions in fieldsets work randomly - race conditions

Re: Splunk variable substitutions in fieldsets work randomly - race conditions