Dashboards & Visualizations

Dashboard Search Bug

jithinmathew
Explorer

Hi all,

I have created a dashboard which takes input from multiple searches based on the radio button selected. The problem is, when I select a different radio button, the search does not change UNLESS I delete the text in the search box and Re-enter it. View the picture below for an example.

alt text

If I click simple search and hit submit, it works as intended. However, once I select another radio field such as serviceID, the search does not change unless I manually re-enter the *.

NOTE: This seems to work before I had the multiple searches included. Logic behind the multiple searches is so that users are able to search for fields that include both ServiceID and Error Text for example.

0 Karma

MuS
SplunkTrust
SplunkTrust

Can you please provide sample events, and the dashboard code? Otherwise it will be like asking the magic number 8 ball 😉

cheers, MuS

0 Karma

jithinmathew
Explorer

Apologies, here is the source code:

Experiment

<input type="time" token="field1">
  <label>TimePicker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="multisearch" searchWhenChanged="false">
  <label>Number of Searches</label>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <change>
    <condition value="1">
      <set token="hideSearch2">2</set>
    </condition>
    <condition value="2">
      <unset token="hideSearch2"></unset>
    </condition>
  </change>
  <default>1</default>
  <initialValue>1</initialValue>
</input>
<input type="radio" token="radioSearchFilter1" searchWhenChanged="false">
  <label>Search Method 1</label>
  <choice value="">Simple Search</choice>
  <choice value="foo=">foo</choice>
  <choice value="bar=">bar</choice>
  <default></default>
</input>
<input type="text" token="searchString1" searchWhenChanged="false">
  <label>Search 1</label>
  <default>*</default>
  <prefix>$radioSearchFilter1$"*</prefix>
  <suffix>*"</suffix>
</input>
<input type="radio" token="radioSearchFilter2" searchWhenChanged="false" rejects="$hideSearch2$">
  <label>Search Method 2</label>
  <choice value="">Simple Search</choice>
  <choice value="Foo=">Foo</choice>
  <choice value="Bar=">Bar</choice>
  <default></default>
</input>
<input type="text" token="searchString2" searchWhenChanged="true" rejects="$hideSearch2$">
  <label>Search 2</label>
  <default>*</default>
  <prefix>$radioSearchFilter2$"*</prefix>
  <suffix>*"</suffix>
</input>


<panel>
  <event>
    <title>Raw Events</title>
    <search>
      <query>index="foo"

| convert ctime(_time) AS TimeStamp
| search $searchString1$ $searchString2$
| table TimeStamp

| sort _time desc
$field1.earliest$
$field1.latest$

TimeStamp
none
progressbar

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...