All Apps and Add-ons

Why is a default * search kicking off in Sideview Utils?

sanfar
Explorer

Hi

I have developed a Splunk search page using sideview utils. However, there is a default search * getting kicked off every time the page is loaded.
I'm not sure where * is specified as it seems to come internally in topmost HTML element. I tried putting the autorun as false, tried using a value setter to block the search by checking the $search$ token, but no luck.
Any ideas?
HTML shown below in runtime debug mode-

Search values added/modified for downstream modules
(none)
Normal keys added/modified for downstream modules
(none)
Search values inherited from upstream
search *
timerange over all time

1 Solution

sideview
SplunkTrust
SplunkTrust

The answer will concern the overall module hierarchy, and the placement of one or more "dispatching" modules in a place that is basically too high up in the hierarchy. If you post it or email it I can spot it quite quickly.

In the end Iit will be something like a JobProgressIndicator that is placed somewhere where it is not downstream from any Search module. Essentially when there is no other search defined at a point in the hierarchy, there is an implicit "" search over all time. If a dispatching module is therefore present somewhere where nothing is overriding that "" search, the "*" search will indeed happen.

Take a look at the "Introduction to the Advanced XML" page in the Sideview Utils docs, they will tell you about "dispatching" modules and there is a section on that page specifically about how, when, where and why searches get kicked off.

If you can't find the misplaced dispatching module or how to rearrange your view, you can email it to me at nick [at] sideviewapps.com and these things are very easy to spot if you know how.

View solution in original post

sideview
SplunkTrust
SplunkTrust

The answer will concern the overall module hierarchy, and the placement of one or more "dispatching" modules in a place that is basically too high up in the hierarchy. If you post it or email it I can spot it quite quickly.

In the end Iit will be something like a JobProgressIndicator that is placed somewhere where it is not downstream from any Search module. Essentially when there is no other search defined at a point in the hierarchy, there is an implicit "" search over all time. If a dispatching module is therefore present somewhere where nothing is overriding that "" search, the "*" search will indeed happen.

Take a look at the "Introduction to the Advanced XML" page in the Sideview Utils docs, they will tell you about "dispatching" modules and there is a section on that page specifically about how, when, where and why searches get kicked off.

If you can't find the misplaced dispatching module or how to rearrange your view, you can email it to me at nick [at] sideviewapps.com and these things are very easy to spot if you know how.

sanfar
Explorer

Hi Nick

There was a CustomBehavior element with a request dispatch in the hierarchy,deleting it solved the issue.

Thanks for your answer!

sideview
SplunkTrust
SplunkTrust

Great. Yes those have been propagating a bit. If you have a CustomBehavior module with a "requriesDispatch" param on it set to true, you're really doing something pretty advanced! Or you copy and pasted it from somewhere and you should remove it. 😃 Happy to help.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...