All Apps and Add-ons

SavedSearch Module - Have useHistory param take in a $foo$ token

cmak
Contributor

I am using a checkbox module that passes down either "True" or "False".
In my SavedSearches module, I have the usehistory param being $foo$, from the above checkbox.
I would like the user to be able to check the box so that the search is run, instead of taking the results from history.
However, the $foo$ token in useHistory param value is not being registered (it seems to be always set as True)

is there a way to do this?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

sideview
SplunkTrust
SplunkTrust

Ah. Interesting. There's a bug in Splunk. If the module param is not "required", then SplunkWeb will basically ignore the "values" param and let the author set any value they feel like. I never noticed that. (line 304 of $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/memoizedviews.py). The mistake appears to go back at least as far as 4.3. I'll report it to Splunk Support.

0 Karma

cmak
Contributor

Thanks for letting me know about the saved search issue.

By the way, I do have the message module, but am not seeing errors. I have noticed this for the past little while.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...