All Apps and Add-ons

Prevent autorun of an upstream base search when setting filters for downstream postprocess

chrisX
Engager

Dear Splunk Community,

I have a dashboard with a base search that aggregates data and takes a bit to run. "Underneath" it are supposed to be a few pulldown modules to filter the following postprocesses.
I would like the base search only to run when the dashboard is loaded, but not to rerun when the downstream pulldown values are selected.
Here only the postprocesses should rerun/autorun.

Any advice on how to achieve that or how to explain my problem more clearly is greatly appreciated.

Thanks in advance,

C

Here my simplified samplecode:

<module name="Search" autoRun="True">
 <param name="search"> my Base Search
 </param>

 <module name="Pulldown">
  <param name="label">PulldownFilter</param>
  <param name="name">Filter</param>

  <module name="PostProcess" autoRun="True">
   <param name="search"> my PostProcessSearch $Filter$
   </param>

   <module name="HiddenChartFormatter"> ...

    <module name="FlashChart"...
    </module>
   </module>
  </module>
 </module>
</module>   

sideview
SplunkTrust
SplunkTrust

I would use a Button module, and set these params on that Button moduile.

 <param name="allowAutoSubmit">True</param>
 <param name="allowSoftSubmit">False</param>

The first one only affects the module at page-load time, and tells the Button to let a push through if the page is loading. The second param only takes affect after page-load-time and tells the module that if a push comes down, do not let it through. The user will then have to click the green button in order to push downstream from the button.

0 Karma

chrisX
Engager

Thanks for your input. Below or above which module would you put the button? Plus I seem to have mixed up what downstream/upstream means...??? My intention is that the child modules (downstream?) of my filters rerun automatically but the parent base search (upstream?) does not. Your answer sounds like the user has to press the button to reload the (downstream?) postprocesses or am I missing something? Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...