All Apps and Add-ons

SavedSearch Module - Have useHistory param take in a $foo$ token

cmak
Contributor

I am using a checkbox module that passes down either "True" or "False".
In my SavedSearches module, I have the usehistory param being $foo$, from the above checkbox.
I would like the user to be able to check the box so that the search is run, instead of taking the results from history.
However, the $foo$ token in useHistory param value is not being registered (it seems to be always set as True)

is there a way to do this?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

sideview
SplunkTrust
SplunkTrust

Ah. Interesting. There's a bug in Splunk. If the module param is not "required", then SplunkWeb will basically ignore the "values" param and let the author set any value they feel like. I never noticed that. (line 304 of $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/memoizedviews.py). The mistake appears to go back at least as far as 4.3. I'll report it to Splunk Support.

0 Karma

cmak
Contributor

Thanks for letting me know about the saved search issue.

By the way, I do have the message module, but am not seeing errors. I have noticed this for the past little while.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...