topic Re: Why does search is not running again until the time is not changed? in Splunk Search

Why does search is not running again until the time is not changed?

mr_brightside — Mon, 05 May 2014 12:32:09 GMT

Hi all,

I would like to know why the search cannot be re-run until i change the time interval for it?

I have my dashboards running on Splunk 6.03. The dashboards were written in Simple XML.

If i open some dashboard, select for example "last 15 minutes" and press "Search", then i'll receive results for that period of time.

Now if i wait for a minute (or for a day) and run the same search on the same dashboard (that was not reloaded) by pressing the "Search" button again nothing will happen.

But, for this situation last 15 minutes will contain another results.

I'm asking about this behaviour because in Advanced XML i was able to click "Search" for some timeinterval to receive data, then i was able to click "Search" again and again without changing the timeinterval, without refreshing the page and the results were displayed.

I haven't found any description in the documentation...

Re: Why does search is not running again until the time is not changed?

cbehm — Tue, 13 May 2014 15:11:30 GMT

I've been searching for a reason and a fix/work-around as well. Personally I classify it as a bug - there's an enabled UI element (the search button) that actually doesn't work.

Re: Why does search is not running again until the time is not changed?

mr_brightside — Wed, 14 May 2014 09:44:33 GMT

Seems like it's really a splunk bug:

http://docs.splunk.com/Documentation/Splunk/6.0.3/ReleaseNotes/Knownissues#REST.2C_Simple_XML.2C_and_Advanced_XML_issues

Submit button in Simple xml will not
re-run search without change to
time-picker. (SPL-77989)

There is no such info in issues for 6.1.0, - apparently they've fixed that. While i've not tested 6.1.x yet i don't think that creating any workaround is necessary here.

Re: Why does search is not running again until the time is not changed?

cbehm — Thu, 15 May 2014 14:09:47 GMT

I just installed 6.1.1 and as far as I can tell it's still broken.

Re: Why does search is not running again until the time is not changed?

mr_brightside — Thu, 29 May 2014 11:07:45 GMT

Working on another issue i've found some examples on how to work with the search manager and with timeline/timerange. The information is present in DEV portal of splunk.

Here are some useful links:

http://dev.splunk.com/view/SP-CAAAEW4
http://dev.splunk.com/view/SP-CAAAET9

I'm sure, that i can change the default behaviour of the Search button with that.

Re: Why does search is not running again until the time is not changed?

mr_brightside — Thu, 26 Jun 2014 14:39:10 GMT

I've returned to this problem.

I've installed 6.1.1. In that version we have FormUtils module:

share/splunk/search_mrsparkle/exposed/js/splunkjs/mvc/simpleform/formutils.js

Here we have method submitForm, that could be extended by our own script:

require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/simpleform/formutils',
    'splunkjs/mvc/simplexml/ready!',
    'splunkjs/ready!'
], function(_, $, mvc, FormUtils) {

    _.extend(FormUtils, {
        submitForm: _.debounce(function(options) {...}
    }
}

This could be good start point to search the final solution.

But, this is only for 6.1.1. If you install 6.0.x you will never find that formutils.js file. In this case i think that there is no common solution for this.

Another suggestion, which is simpler, is just to take saved url (after pressing the submit button, our filters are saved in the url) and to reload the page with it.

I would like to know, that solution is the best. Has anybody solved that in another way?