Dashboards & Visualizations

Dashboard Search Bug

jithinmathew
Explorer

Hi all,

I have created a dashboard which takes input from multiple searches based on the radio button selected. The problem is, when I select a different radio button, the search does not change UNLESS I delete the text in the search box and Re-enter it. View the picture below for an example.

alt text

If I click simple search and hit submit, it works as intended. However, once I select another radio field such as serviceID, the search does not change unless I manually re-enter the *.

NOTE: This seems to work before I had the multiple searches included. Logic behind the multiple searches is so that users are able to search for fields that include both ServiceID and Error Text for example.

0 Karma

MuS
Legend

Can you please provide sample events, and the dashboard code? Otherwise it will be like asking the magic number 8 ball 😉

cheers, MuS

0 Karma

jithinmathew
Explorer

Apologies, here is the source code:

Experiment

<input type="time" token="field1">
  <label>TimePicker</label>
  <default>
    <earliest>-60m@m</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="multisearch" searchWhenChanged="false">
  <label>Number of Searches</label>
  <choice value="1">1</choice>
  <choice value="2">2</choice>
  <change>
    <condition value="1">
      <set token="hideSearch2">2</set>
    </condition>
    <condition value="2">
      <unset token="hideSearch2"></unset>
    </condition>
  </change>
  <default>1</default>
  <initialValue>1</initialValue>
</input>
<input type="radio" token="radioSearchFilter1" searchWhenChanged="false">
  <label>Search Method 1</label>
  <choice value="">Simple Search</choice>
  <choice value="foo=">foo</choice>
  <choice value="bar=">bar</choice>
  <default></default>
</input>
<input type="text" token="searchString1" searchWhenChanged="false">
  <label>Search 1</label>
  <default>*</default>
  <prefix>$radioSearchFilter1$"*</prefix>
  <suffix>*"</suffix>
</input>
<input type="radio" token="radioSearchFilter2" searchWhenChanged="false" rejects="$hideSearch2$">
  <label>Search Method 2</label>
  <choice value="">Simple Search</choice>
  <choice value="Foo=">Foo</choice>
  <choice value="Bar=">Bar</choice>
  <default></default>
</input>
<input type="text" token="searchString2" searchWhenChanged="true" rejects="$hideSearch2$">
  <label>Search 2</label>
  <default>*</default>
  <prefix>$radioSearchFilter2$"*</prefix>
  <suffix>*"</suffix>
</input>


<panel>
  <event>
    <title>Raw Events</title>
    <search>
      <query>index="foo"

| convert ctime(_time) AS TimeStamp
| search $searchString1$ $searchString2$
| table TimeStamp

| sort _time desc
$field1.earliest$
$field1.latest$

TimeStamp
none
progressbar

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...