Dashboards & Visualizations

Dashboard Search Bug

jithinmathew
Explorer

Hi all,

I have created a dashboard which takes input from multiple searches based on the radio button selected. The problem is, when I select a different radio button, the search does not change UNLESS I delete the text in the search box and Re-enter it. View the picture below for an example.

alt text

If I click simple search and hit submit, it works as intended. However, once I select another radio field such as serviceID, the search does not change unless I manually re-enter the *.

NOTE: This seems to work before I had the multiple searches included. Logic behind the multiple searches is so that users are able to search for fields that include both ServiceID and Error Text for example.

0 Karma

MuS
SplunkTrust
SplunkTrust

Can you please provide sample events, and the dashboard code? Otherwise it will be like asking the magic number 8 ball 😉

cheers, MuS

0 Karma

jithinmathew
Explorer

Apologies, here is the source code:

Experiment

<input type="time" token="field1">
  <label>TimePicker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="multisearch" searchWhenChanged="false">
  <label>Number of Searches</label>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <change>
    <condition value="1">
      <set token="hideSearch2">2</set>
    </condition>
    <condition value="2">
      <unset token="hideSearch2"></unset>
    </condition>
  </change>
  <default>1</default>
  <initialValue>1</initialValue>
</input>
<input type="radio" token="radioSearchFilter1" searchWhenChanged="false">
  <label>Search Method 1</label>
  <choice value="">Simple Search</choice>
  <choice value="foo=">foo</choice>
  <choice value="bar=">bar</choice>
  <default></default>
</input>
<input type="text" token="searchString1" searchWhenChanged="false">
  <label>Search 1</label>
  <default>*</default>
  <prefix>$radioSearchFilter1$"*</prefix>
  <suffix>*"</suffix>
</input>
<input type="radio" token="radioSearchFilter2" searchWhenChanged="false" rejects="$hideSearch2$">
  <label>Search Method 2</label>
  <choice value="">Simple Search</choice>
  <choice value="Foo=">Foo</choice>
  <choice value="Bar=">Bar</choice>
  <default></default>
</input>
<input type="text" token="searchString2" searchWhenChanged="true" rejects="$hideSearch2$">
  <label>Search 2</label>
  <default>*</default>
  <prefix>$radioSearchFilter2$"*</prefix>
  <suffix>*"</suffix>
</input>


<panel>
  <event>
    <title>Raw Events</title>
    <search>
      <query>index="foo"

| convert ctime(_time) AS TimeStamp
| search $searchString1$ $searchString2$
| table TimeStamp

| sort _time desc
$field1.earliest$
$field1.latest$

TimeStamp
none
progressbar

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...