All Apps and Add-ons

Unable to set autoRun on nested search

sbsbb
Builder

I have :
URLloader
Search autoRun=true
Pulldown
Pulldown
Pulldown
Button
Search

  • the first search is populating the pulldown with a |metadata search
  • the second one is supposed to launch a real search, but I want the user beeing able to choose the pulldown before (so I can't have a bette search, only based on some sources)

But in the Sideview editor, I can't unset autoRun=true on elements after the first search. And in the code, even if autorun=true is not set, the second search is also runing automatically...

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

What you want to do, is leave the autoRun the way it is and set the allowAutoSubmit param to True on the Button module. That will get you what you want. The autoRun=True is actually necessary to populate those Pulldowns when the page loads. But the allowAutoSubmit param set to False will make the Button module stop the downstream search(es) from dispatching.

Also there is no such thing as autoRun="False". Sometimes you see people put autoRun="False" into views but trust me - it has no effect at all besides to confuse people.

Also, it's a best practice to pull up the autoRun="True" attribute up to the highest level - in this case I would set it on the URLLoader module and not on that Search module. This is just a good habit to get into, to minimize the chances of ever nesting an autoRun="True" inside another one. Because the highest module in a dashboard is often a Search or HiddenSearch module, and because the highest module is the one that usually has the autoRun="True", there is a widespread misconception that autoRun is a param on those modules specifically, but it is not. Instead autoRun is a generic attribute that you can put on any module that says "start the ball rolling from this point and dispatch any searches that you find downstream from here."

For a good explanation of this and more, and of how the Advanced XML works, download a recent copy of the Sideview Utils app and in the embedded Sideview docs read "Key Techniques > Overview of the Advanced XML"

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

What you want to do, is leave the autoRun the way it is and set the allowAutoSubmit param to True on the Button module. That will get you what you want. The autoRun=True is actually necessary to populate those Pulldowns when the page loads. But the allowAutoSubmit param set to False will make the Button module stop the downstream search(es) from dispatching.

Also there is no such thing as autoRun="False". Sometimes you see people put autoRun="False" into views but trust me - it has no effect at all besides to confuse people.

Also, it's a best practice to pull up the autoRun="True" attribute up to the highest level - in this case I would set it on the URLLoader module and not on that Search module. This is just a good habit to get into, to minimize the chances of ever nesting an autoRun="True" inside another one. Because the highest module in a dashboard is often a Search or HiddenSearch module, and because the highest module is the one that usually has the autoRun="True", there is a widespread misconception that autoRun is a param on those modules specifically, but it is not. Instead autoRun is a generic attribute that you can put on any module that says "start the ball rolling from this point and dispatch any searches that you find downstream from here."

For a good explanation of this and more, and of how the Advanced XML works, download a recent copy of the Sideview Utils app and in the embedded Sideview docs read "Key Techniques > Overview of the Advanced XML"

0 Karma

sbsbb
Builder

Ok in fact what I was searching for is
allowAutoSubmit=false

It works ! I've really missunderstood autoRun, thanks for the explanations

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...