Dashboards & Visualizations

Dealing with empty selections in complex forms

lassel
Communicator

I have the following (simplified) dynamic dashboard.
You can see the query beeing performed in html.

I want the sourcetype selection is optional on this dashboard. But as it is the $sourcetype$ token is not resolved until I make a selection in the sourcetype. Setting a default sourcetype to empty doesn't work, because that will make an invalid search and also because the empty selection stays when I select an index.

  • How can I make the search run, even if no selection is made to sourcetype?
  • How can I clear the (invalid) sourcetype selections, when I select an index?

    index=* | dedup index 0 index index true | search index= false * <query>$index$ | dedup sourcetype</query> 0 sourcetype sourcetype ( sourcetype=" " OR )
    @d now
              $index$ $sourcetype$ $search$
            
    <query>$index$ $sourcetype$ $search$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest>
0 Karma
1 Solution

helge
Builder

You could use a token forwarder like this:

Don't use the sourcetype token in your search directly. Instead, build a new token with the help of a token forwarder. In the Javascript function that actually sets the new forwarded token's value you can easily provide a default value.

For possible alternatives also look at token change event handlers and token filters, documented on the same page as forwarders.

View solution in original post

0 Karma

helge
Builder

You could use a token forwarder like this:

Don't use the sourcetype token in your search directly. Instead, build a new token with the help of a token forwarder. In the Javascript function that actually sets the new forwarded token's value you can easily provide a default value.

For possible alternatives also look at token change event handlers and token filters, documented on the same page as forwarders.

0 Karma

lassel
Communicator

Did you notice that I use simple XML?

But I need to convert my dashboard to html to do it?
It seems like a complex task for a simple goal..

0 Karma

helge
Builder

You don't have to convert your dashboard to HTML, you only need to include a script like this:

<form script="myscript.js"

In that script you can then use the technique I described.

0 Karma

lassel
Communicator

Oh! Great. I had no idea you could do that!

0 Karma

lassel
Communicator

I would also really really like to know, how I can make the user experience of my dashboard, more like the full search page.

0 Karma

lassel
Communicator

i'd still like an answer to this question ...

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...