All Apps and Add-ons

SavedSearch Module - Have useHistory param take in a $foo$ token

cmak
Contributor

I am using a checkbox module that passes down either "True" or "False".
In my SavedSearches module, I have the usehistory param being $foo$, from the above checkbox.
I would like the user to be able to check the box so that the search is run, instead of taking the results from history.
However, the $foo$ token in useHistory param value is not being registered (it seems to be always set as True)

is there a way to do this?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

sideview
SplunkTrust
SplunkTrust

Ah. Interesting. There's a bug in Splunk. If the module param is not "required", then SplunkWeb will basically ignore the "values" param and let the author set any value they feel like. I never noticed that. (line 304 of $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/memoizedviews.py). The mistake appears to go back at least as far as 4.3. I'll report it to Splunk Support.

0 Karma

cmak
Contributor

Thanks for letting me know about the saved search issue.

By the way, I do have the message module, but am not seeing errors. I have noticed this for the past little while.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...