Dashboards & Visualizations

Dashboard Search Bug

jithinmathew
Explorer

Hi all,

I have created a dashboard which takes input from multiple searches based on the radio button selected. The problem is, when I select a different radio button, the search does not change UNLESS I delete the text in the search box and Re-enter it. View the picture below for an example.

alt text

If I click simple search and hit submit, it works as intended. However, once I select another radio field such as serviceID, the search does not change unless I manually re-enter the *.

NOTE: This seems to work before I had the multiple searches included. Logic behind the multiple searches is so that users are able to search for fields that include both ServiceID and Error Text for example.

0 Karma

MuS
SplunkTrust
SplunkTrust

Can you please provide sample events, and the dashboard code? Otherwise it will be like asking the magic number 8 ball 😉

cheers, MuS

0 Karma

jithinmathew
Explorer

Apologies, here is the source code:

Experiment

<input type="time" token="field1">
  <label>TimePicker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="multisearch" searchWhenChanged="false">
  <label>Number of Searches</label>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <change>
    <condition value="1">
      <set token="hideSearch2">2</set>
    </condition>
    <condition value="2">
      <unset token="hideSearch2"></unset>
    </condition>
  </change>
  <default>1</default>
  <initialValue>1</initialValue>
</input>
<input type="radio" token="radioSearchFilter1" searchWhenChanged="false">
  <label>Search Method 1</label>
  <choice value="">Simple Search</choice>
  <choice value="foo=">foo</choice>
  <choice value="bar=">bar</choice>
  <default></default>
</input>
<input type="text" token="searchString1" searchWhenChanged="false">
  <label>Search 1</label>
  <default>*</default>
  <prefix>$radioSearchFilter1$"*</prefix>
  <suffix>*"</suffix>
</input>
<input type="radio" token="radioSearchFilter2" searchWhenChanged="false" rejects="$hideSearch2$">
  <label>Search Method 2</label>
  <choice value="">Simple Search</choice>
  <choice value="Foo=">Foo</choice>
  <choice value="Bar=">Bar</choice>
  <default></default>
</input>
<input type="text" token="searchString2" searchWhenChanged="true" rejects="$hideSearch2$">
  <label>Search 2</label>
  <default>*</default>
  <prefix>$radioSearchFilter2$"*</prefix>
  <suffix>*"</suffix>
</input>


<panel>
  <event>
    <title>Raw Events</title>
    <search>
      <query>index="foo"

| convert ctime(_time) AS TimeStamp
| search $searchString1$ $searchString2$
| table TimeStamp

| sort _time desc
$field1.earliest$
$field1.latest$

TimeStamp
none
progressbar

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...