PullDown is having downstream effect

[ncbshiva]

Hi,

I have four pulldowns, which will populate the list from the search query.
Every change of a value on a pulldown causes all pulldowns whose values are filled using a search to reload.I dont want the cascading effect. If i select one pulldown , the others should not change.

This is my pulldown code

<module name="Search" layoutPanel="panel_row1_col2" autoRun="True">
   <param name="search">
     source="*\\CPES_List_Details.csv" DeviceAvailable="YES"
     | table VendorName
     | eval flag =if(VendorName="Thomson",1,0) 
     | table VendorName,flag 
     | sort -flag 
     | table VendorName</param>
   <module name="Pulldown">
     <param name="name">VendorName</param>
     <param name="label">VendorName:</param>
     <param name="template">$value$</param>
     <param name="float">left</param>
     <param name="postProcess">dedup $name$</param>
     <param name="staticOptions"/>
     <param name="valueField">$name$</param>

     <module name="Search" layoutPanel="panel_row1_col2" autoRun="True">
       <param name="search">
         | inputlookup months.csv
         | sort time</param>
       <module name="Pulldown">
         <param name="name">FromMonth</param>
         <param name="label">From:</param>
         <param name="template">$value$</param>
         <param name="float">left</param>
         <param name="postProcess">dedup $name$</param>
         <param name="valueField">$name$</param>
         <param name="staticOptions"/>
         <module name="Search" layoutPanel="panel_row1_col2" autoRun="True">
           <param name="search">
             | inputlookup bds_year.csv
             | table FromYear</param>
           <module name="Pulldown">
             <param name="name">FromYear</param>
             <param name="label">-</param>
             <param name="template">$value$</param>
             <param name="float">left</param>
             <param name="valueField">$name$</param>
             <param name="staticOptions"/>
             <module name="Search" layoutPanel="panel_row1_col2" autoRun="True">
               <param name="search">
                 | inputlookup months.csv | rename FromMonth to ToMonth
                 | table time,ToMonth
                 | sort -time</param>
               <module name="Pulldown">
                 <param name="name">ToMonth</param>
                 <param name="label">To:</param>
                 <param name="template">$value$</param>
                 <param name="float">left</param>
                 <param name="postProcess">dedup $name$</param>
                 <param name="valueField">$name$</param>
                 <param name="staticOptions"/>
                 <module name="Search" layoutPanel="panel_row1_col2" autoRun="True">
                   <param name="search">
                     | inputlookup bds_year.csv
                     | rename FromYear as ToYear
                     | table ToYear
                   </param>
                   <module name="Pulldown">
                     <param name="name">ToYear</param>
                     <param name="label">-</param>
                     <param name="template">$value$</param>
                     <param name="float">left</param>
                     <param name="valueField">$name$</param>
                     <param name="staticOptions"/>

Please help me in this

Thanking in advance

[sideview · Accepted solution]

OK. First some high level comments.

The simplest way to stop them from refreshing is of course to make the 2 month Pulldowns and the 2 year Pulldowns into static Pulldowns. The obvious and pretty big drawback is that you'd have to go and update all of the views at the top of every new year. The second drawback is that your vierw has to have a whole lot of XML in the form of all the <staticOptions> options.
But of course if they were static then nothing would re-run or re-render when an upstream element was changed.

Secondly, on a Splunk system that is performing well, all these little calls to inputlookup should run, finish and render extremely fast, or nearly instantaneous. All four pulldowns should repopulate in under a half a second. So if the cascading refresh of the dynamic Pulldowns is taking a long time it may actually be a sign that something is more fundamentally wrong on the Splunk instance performance wise.

That said, here's a solution. This just piles all the information to render all 5 Pulldowns into a single Search up top, and then we use postProcess in each Pulldown to get out the stuff that we need. This postprocess approach can be taken too far but here with these small searches it is absolutely fine. Also the use of append is often taken too far, but here with tiny fast-running inputlookup searches it will be fine. (NOTE: if inputlookup is NOT returning in under a second, all bets are off and something bad is going on)

<module name="Search" layoutPanel="panel_row1_col1" autoRun="True">
  <param name="search">
   source="*\\CPES_List_Details.csv" DeviceAvailable="YES"
   | table VendorName
   | eval flag =if(VendorName="Thomson",1,0) 
   | table VendorName,flag 
   | sort -flag 
   | table VendorName
   | append [| inputlookup months | eval ToMonth=name | eval FromMonth=name | fields ToMonth FromMonth]
   | append [| inputlookup years | eval ToYear=name | eval FromYear=name | fields ToYear FromYear]
  </param>
  <module name="Pulldown">
    <param name="name">VendorName</param>
    <param name="label">VendorName:</param>
    <param name="template">$value$</param>
    <param name="float">left</param>
    <param name="postProcess">dedup $name$</param>
    <param name="staticOptions"/>
    <param name="valueField">$name$</param>

    <module name="Pulldown">
      <param name="name">FromMonth</param>
      <param name="label">From:</param>
      <param name="template">$value$</param>
      <param name="float">left</param>
      <param name="postProcess">dedup $name$</param>
      <param name="valueField">$name$</param>
      <param name="staticOptions"/>

      <module name="Pulldown">
        <param name="name">FromYear</param>
        <param name="label">-</param>
        <param name="template">$value$</param>
        <param name="float">left</param>
        <param name="postProcess">dedup $name$</param>
        <param name="valueField">$name$</param>
        <param name="staticOptions"/>

        <module name="Pulldown">
          <param name="name">ToMonth</param>
          <param name="label">To:</param>
          <param name="template">$value$</param>
          <param name="float">left</param>
          <param name="postProcess">dedup $name$</param>
          <param name="valueField">$name$</param>
          <param name="staticOptions"/>

          <module name="Pulldown">
            <param name="name">ToYear</param>
            <param name="label">-</param>
            <param name="template">$value$</param>
            <param name="float">left</param>
            <param name="postProcess">dedup $name$</param>
            <param name="valueField">$name$</param>
            <param name="staticOptions"/>

            <module name="HTML">
              <param name="html"><![CDATA[
               $VendorName$<br>
               $FromMonth$<br>
               $FromYear$<br>
               $ToMonth$<br>
               $ToYear$
               ]]></param>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</module>

[ncbshiva]

s, years are same ....

[sideview]

And are the years the same? Presumably they're both some year through 2014 ?

[ncbshiva]

Hai sideview thanks for your answer..

12 months is same for both ToMonth and FromMonth.
i have removed all "autorun=True" , but still it is not working .

Please help me in this

[sideview]

Oh and you ABSOLUTELY want to remove all of these autoRun="True" attributes except for the very topmost one.

I recorded a brief overview of the Advanced XML, and after you watch it, one of the things you'll come away understanding is why multiple autoRun attributes is such a bad idea! https://www.youtube.com/watch?v=Onol4w4NnnM

[sideview]

If we can combine some or all of these searches into a single search and then use postProcess to carve out the fields we want for each Pulldown, then the Pulldowns would in most cases not refresh. And even if they did it would be so fast as to be unnoticeable.

Are all 12 months in both ToMonth and FromMonth? Likewise are the same years the values in ToYear and FromYear? If so that will make rolling this up quite a lot easier. Let me know and I'll give you a solution that does it all without cascading.