topic Re: Splunk dashboard : Text input token is caching the previously entered value. in Splunk Search

Splunk dashboard : Text input token is caching the previously entered value.

bhavika100 — Fri, 23 Jul 2021 02:04:33 GMT

I have a dashboard with multiple inputs. These inputs are like filters on top of basic search. I want

1. if phone mdn and both devicemdn is provided then its a OR between them on top of the base search

base search | search phonemdn=<value> OR devicemdn=<value>

2. if only phone mdn is provided then should be

base search | search phonemdn=<value>

3. if only device mdn is provided then should be

base search | search devicemdn=<value>

Here is my dashboard xml:

<form> <label>Dashboard</label> <fieldset submitButton="true" autoRun="true"> <input type="text" token="phonemdn" searchWhenChanged="false"> <label>PHONE MDN</label> <default></default> <change> <condition> <eval token="phonemdn_exp">if(len(trim($value$)) == 0,"","| search phonemdn=".$value$)</eval> </condition> </change> </input> <input type="text" token="devicemdn"> <label>DEVICE MDN</label> <default></default> <change> <condition> <eval token="devicemdn_exp">if(len(trim($value$)) == 0, "" , if(len(trim($phonemdn$)) == 0, "| search devicemdn=".$value$, "OR devicemdn=".$value$))</eval> </condition> </change> </input> <input type="dropdown" token="logtype" searchWhenChanged="true"> <label>LOG TYPE</label> <choice value="*">ALL</choice> <choice value="server">Watch</choice> <choice value="application">Application</choice> <change> <condition value="server"> <set token="filter_search_base">| search index=new | spath app | search app=newapp </set> <set token="logtype_lab">logtype=server</set> <set token="logtype_exp">| search source=Band | eval source="Band"</set> </condition> <condition value="application"> <set token="filter_search_base">| search index=main | spath app | search app!=simulator</set> <set token="logtype_lab">logtype=Application</set> <set token="logtype_exp">| search source=Application</set> </condition> <condition value="*"> <set token="filter_search_base">|multisearch [search index=new | spath app | search app=newapp] [search index=main | spath app | search app!=simulator]</set> <set token="logtype_lab">All Source</set> <set token="logtype_exp"></set> </condition> </change> </input> </fieldset> <row> <panel> <title>SEARCHING: $logtype_lab$ $phonemdn_exp$ $devicemdn_exp$</title> <search> <query>$filter_search_base$ $phonemdn_exp$ $devicemdn_exp$</query> <earliest>$timefield.earliest$</earliest> <latest>$timefield.latest$</latest> </search> </panel> </row> </form>

So my first query always works but later I feel like the input value for phonemdn and devicemdn is getting cached and future query didn't work as expected.

if I have input both phonemdn and devicemdn : query is base search | search phonemdn=<value> OR devicemdn=<value>

then if I delete value from phone mdn and only keep devicemdn then,

actual query : base search OR devicemdn=<value>

expected query : base search | search devicemdn=<value>

I feel like somehow the phonemdn value from the first query is getting cached somehow. Please help me to resolve this issue. let me know if you need more information. thanks!!

Re: Splunk dashboard : Text input token is caching the previously entered value.

kamlesh_vaghela — Fri, 23 Jul 2021 07:44:51 GMT

@bhavika100

Generally I'm using search approach for this kind of situations. Can you please try this?

<form> <label>Dashboard</label> <search> <done> <set token="condition">$result.search$</set> </done> <query>| makeresults | eval phonemdn="$tkn_phonemdn$",devicemdn="$tkn_devicemdn$" | eval search=case(len(trim(phonemdn))==0 AND len(trim(devicemdn))==0,"", len(trim(phonemdn))==0 AND len(trim(devicemdn))!=0,"| search devicemdn=".devicemdn,len(trim(phonemdn))!=0 AND len(trim(devicemdn))==0,"| search phonemdn=".phonemdn, len(trim(phonemdn))!=0 AND len(trim(devicemdn))!=0,"| search phonemdn=".phonemdn." OR devicemdn=".devicemdn )</query> </search> <fieldset submitButton="true" autoRun="true"> <input type="text" token="phonemdn" searchWhenChanged="false"> <label>PHONE MDN</label> <default></default> <change> <set token="tkn_phonemdn">$value$</set> </change> </input> <input type="text" token="devicemdn"> <label>DEVICE MDN</label> <default></default> <change> <set token="tkn_devicemdn">$value$</set> </change> </input> </fieldset> <row> <panel> <title>SEARCHING: $condition$</title> <table> <search> <query>filter_search_base $condition$</query> </search> </table> </panel> </row> </form>

$condition$ will have your required condition and do necessary changes in condition for your required panel.

Thanks
KV
▄︻̷̿┻̿═━一 😎

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Splunk dashboard : Text input token is caching the previously entered value.

ITWhisperer — Fri, 23 Jul 2021 09:25:41 GMT

Instead of this

<eval token="devicemdn_exp">if(len(trim($value$)) == 0, "" , if(len(trim($phonemdn$)) == 0, "| search devicemdn=".$value$, "OR devicemdn=".$value$))</eval>

try this

<eval token="devicemdn_exp">if(len(trim($value$)) == 0, "" , if(len(trim($form.phonemdn$)) == 0, "| search devicemdn=".$value$, "OR devicemdn=".$value$))</eval>

Re: Splunk dashboard : Text input token is caching the previously entered value.

bhavika100 — Fri, 23 Jul 2021 18:08:37 GMT

@ITWhisperer ..Thanks for checking. I tried this but it didn't work for me.

Re: Splunk dashboard : Text input token is caching the previously entered value.

bhavika100 — Fri, 23 Jul 2021 18:21:13 GMT

@kamlesh_vaghela Thanks for quick response. I tried this solution and after some minor change it worked for me.