Dashboards & Visualizations

Dealing with empty selections in complex forms

lassel
Communicator

I have the following (simplified) dynamic dashboard.
You can see the query beeing performed in html.

I want the sourcetype selection is optional on this dashboard. But as it is the $sourcetype$ token is not resolved until I make a selection in the sourcetype. Setting a default sourcetype to empty doesn't work, because that will make an invalid search and also because the empty selection stays when I select an index.

  • How can I make the search run, even if no selection is made to sourcetype?
  • How can I clear the (invalid) sourcetype selections, when I select an index?

    index=* | dedup index 0 index index true | search index= false * <query>$index$ | dedup sourcetype</query> 0 sourcetype sourcetype ( sourcetype=" " OR )
    @d now
              $index$ $sourcetype$ $search$
            
    <query>$index$ $sourcetype$ $search$</query> <earliest>$time.earliest$</earliest> <latest>$time.latest$</latest>
0 Karma
1 Solution

helge
Builder

You could use a token forwarder like this:

Don't use the sourcetype token in your search directly. Instead, build a new token with the help of a token forwarder. In the Javascript function that actually sets the new forwarded token's value you can easily provide a default value.

For possible alternatives also look at token change event handlers and token filters, documented on the same page as forwarders.

View solution in original post

0 Karma

helge
Builder

You could use a token forwarder like this:

Don't use the sourcetype token in your search directly. Instead, build a new token with the help of a token forwarder. In the Javascript function that actually sets the new forwarded token's value you can easily provide a default value.

For possible alternatives also look at token change event handlers and token filters, documented on the same page as forwarders.

0 Karma

lassel
Communicator

Did you notice that I use simple XML?

But I need to convert my dashboard to html to do it?
It seems like a complex task for a simple goal..

0 Karma

helge
Builder

You don't have to convert your dashboard to HTML, you only need to include a script like this:

<form script="myscript.js"

In that script you can then use the technique I described.

0 Karma

lassel
Communicator

Oh! Great. I had no idea you could do that!

0 Karma

lassel
Communicator

I would also really really like to know, how I can make the user experience of my dashboard, more like the full search page.

0 Karma

lassel
Communicator

i'd still like an answer to this question ...

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...