All Apps and Add-ons

Time Ranges for tabs search and main search

rizzo75
Path Finder

I created a dashboard using Sideview Utils.

Here are the modules used and order:
|root view|
|Search|
|Tabs|
|TimeRangePicker|
|Search|
|Table|

Currently, the 1st search runs using the earliest & latest values being set, then the 2nd search runs also using the earliest & latest values set in the 1st search.

I want the 1st search to run to populate the tabs, then stop until the user selects a value in the time range picker, is this possible?

Thanks,
Joe

0 Karma

sideview
SplunkTrust
SplunkTrust

The simplest answer to this sort of question is to slightly modify your design so that there is a Button downstream from the TimeRangePicker and upstream from the Search.

You would give that Button module an allowAutoSubmit param of False. (Whether you also give it an allowSoftSubmit param of False is a separate matter and entirely up to you.)

What this will do, is that the initial autoRun push kicks off that search, the search results populate the Tabs, but then when it hits the indomitable Button with allowAutoSubmit set to False, the push is stopped. The user than has to click the green button in order to proceed.

If you take your question and you replace TimeRangePicker with Pulldown, there is another answer involving the Gate module. Gate is an invisible module that has 2 different "gatelike" use cases. The first is that it can block pushes until one or more keys are set from upstream modules So you can have it block as long as a "select..." item is selected in one or more Pulldowns. Here however, the TimeRangePicker doesn't really have a "select..." state so it always has a key so Gate would have nothing to grab onto.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...