Dashboards & Visualizations

Simple xml submit button

mschellhouse
Path Finder

The submit button on simple xml seems to have no effect. I have a dropdown that runs a query and sets tokens for earliest/latest based on a selection. Every change in the dropdown reruns the search in subsequent dashboard panel.

Here is a link to the simple xml code (someday I will have enough Karma points to be productive on here)

https://imgur.com/IXw5jzN

0 Karma
1 Solution

maciep
Champion

would you be able to use the timeframe token itself in a base search, and then set your tokens once that search is finalized? Not sure how much more trouble that would be, but might be a workaround for now? This way you're actually using the token that should respect the submit button.

Maybe something like this, where the input section is the same as yours minus the change tag. Note, I just typed this out with absolutely no testing so probably won't work as is.

<form>
    <fieldset>
        <input>
        </input>
    </fieldset>
    <search id="set_token">
        <query> | stats count | eval tf=$timeframe$ | rex field=tf "^(?<begin>[^-]+)-(?<end>.+)" | eval begin=strptime(begin,"%m/%d/%y %H:%M:%S"),end=strptime(end,"%m/%d/%y %H:%M:%S") | fields begin, end</query>
        <finalized>
            <set token="tok_earliest">$result.begin$</set>
            <set token="tok_latest">$result.end$</set>
        </finalized>
    </search>
    <row>
        <panel></panel>
    </row>
    .
    .
    .
</form>

updated as per feedback for typos.

View solution in original post

maciep
Champion

would you be able to use the timeframe token itself in a base search, and then set your tokens once that search is finalized? Not sure how much more trouble that would be, but might be a workaround for now? This way you're actually using the token that should respect the submit button.

Maybe something like this, where the input section is the same as yours minus the change tag. Note, I just typed this out with absolutely no testing so probably won't work as is.

<form>
    <fieldset>
        <input>
        </input>
    </fieldset>
    <search id="set_token">
        <query> | stats count | eval tf=$timeframe$ | rex field=tf "^(?<begin>[^-]+)-(?<end>.+)" | eval begin=strptime(begin,"%m/%d/%y %H:%M:%S"),end=strptime(end,"%m/%d/%y %H:%M:%S") | fields begin, end</query>
        <finalized>
            <set token="tok_earliest">$result.begin$</set>
            <set token="tok_latest">$result.end$</set>
        </finalized>
    </search>
    <row>
        <panel></panel>
    </row>
    .
    .
    .
</form>

updated as per feedback for typos.

mschellhouse
Path Finder

I am trying to implement this approach and it doesn't seem to set the tokens. Except for one small typo, your logic is solid. Dumping the query into a panel and running does work. Seems like there may be a limitation or some special condition in doing this in a base search?

0 Karma

mschellhouse
Path Finder

Changing $row.xxx$ to $result.xxx$ appears to have worked.

rjthibod
Champion

What you are seeing is a side-effect of what I posted here: https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html

Basically, any token changes inside of the <change> block are immediate regardless of how you set searchWhenChanged. There is no built-in workaround in SimpleXML that doesn't require you changing how you do inputs. The only other option is implement the logic in JavaScript, which is probably overkill.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...