topic Re: Simple xml submit button in Dashboards & Visualizations

Simple xml submit button

mschellhouse — Tue, 28 Nov 2017 16:14:30 GMT

The submit button on simple xml seems to have no effect. I have a dropdown that runs a query and sets tokens for earliest/latest based on a selection. Every change in the dropdown reruns the search in subsequent dashboard panel.

Here is a link to the simple xml code (someday I will have enough Karma points to be productive on here)

https://imgur.com/IXw5jzN

Re: Simple xml submit button

rjthibod — Tue, 28 Nov 2017 16:29:19 GMT

What you are seeing is a side-effect of what I posted here: https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html

Basically, any token changes inside of the <change> block are immediate regardless of how you set searchWhenChanged. There is no built-in workaround in SimpleXML that doesn't require you changing how you do inputs. The only other option is implement the logic in JavaScript, which is probably overkill.

Re: Simple xml submit button

maciep — Tue, 28 Nov 2017 17:38:48 GMT

would you be able to use the timeframe token itself in a base search, and then set your tokens once that search is finalized? Not sure how much more trouble that would be, but might be a workaround for now? This way you're actually using the token that should respect the submit button.

Maybe something like this, where the input section is the same as yours minus the change tag. Note, I just typed this out with absolutely no testing so probably won't work as is.

<form>
    <fieldset>
        <input>
        </input>
    </fieldset>
    <search id="set_token">
        <query> | stats count | eval tf=$timeframe$ | rex field=tf "^(?<begin>[^-]+)-(?<end>.+)" | eval begin=strptime(begin,"%m/%d/%y %H:%M:%S"),end=strptime(end,"%m/%d/%y %H:%M:%S") | fields begin, end</query>
        <finalized>
            <set token="tok_earliest">$result.begin$</set>
            <set token="tok_latest">$result.end$</set>
        </finalized>
    </search>
    <row>
        <panel></panel>
    </row>
    .
    .
    .
</form>

updated as per feedback for typos.

Re: Simple xml submit button

mschellhouse — Tue, 28 Nov 2017 20:30:44 GMT

I am trying to implement this approach and it doesn't seem to set the tokens. Except for one small typo, your logic is solid. Dumping the query into a panel and running does work. Seems like there may be a limitation or some special condition in doing this in a base search?

Re: Simple xml submit button

mschellhouse — Tue, 28 Nov 2017 21:00:53 GMT

Changing $row.xxx$ to $result.xxx$ appears to have worked.