Dashboards & Visualizations

Drop down with Saved Search does not respond to time token change and Submit button present

altink
Builder

Dear All

I have a Drop Down (named Database) which loads list of options dynamically via a search initially started in a saved-search, saved top of the form. The form has also a time token input and a Submit button. The saved search is bound to the time token (see code below)
The problem is that when I change the time in the time token - the Drop-Down list of values is not refreshed.

Please see the code below, start of the form to Submit button:

<form>
  <label>Scan Compare 001</label>

  <!-- This limits events passed to post-process search -->
  <search id="vln_base">
    <query>
      `mc_vln`
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>

  <search id="vln_cmp">
    <query>`mc_comp($field_scan_run_id$,$field_scan_bs_id$)`</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>

  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>

    <input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search base="vln_base">
        <query>DEDUP DB_NAME | FIELDS DB_NAME</query>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_run_id" searchWhenChanged="false">
      <label>Scan Id Run</label>
      <search base="vln_base">
        <query>search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID
| sort - SCAN_DT_START</query>
      </search>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_run_id_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_bs_id" searchWhenChanged="false">
      <label>Scan Id Baseline</label>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_bs_id_no_quotes">$value$</set>
      </change>
      <search base="vln_base">
        <query>
          <![CDATA[          
          search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID 
| sort - SCAN_DT_START 
]]>
        </query>
      </search>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_cmp_code" searchWhenChanged="true">
      <label>Comparison</label>
      <showClearButton>false</showClearButton>
      <choice value="ALL_NO_FIELD_ALL">ALL</choice>
      <choice value="Unchanged">Changes Only</choice>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>

.......................................................................................................

If I renounce using a saved search in the Database drop down, and use a direct search (see code below)

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search base="vln_base">
        <query>DEDUP DB_NAME | FIELDS DB_NAME</query>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

replaced with

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

then the Database Drop Down starts responding to changes in token, it reloads the options list each time the time is changed.

Back into the problematic case with saved search - I can have the Database Drop Down reloaded by pressing the Submit button. But I need to have it respond to the Time Picker (token) - the Submit button is needed for later (in form) dashboards.

My question:
Q1. Why the options list search direct VS / saved-search makes a difference on this?
Q2. How can I have this problem fixed by using saved-search in the Drop-Down?

best regards,
Altin

at your disposal for further info/query

0 Karma

altink
Builder

resolved by enabling Search on Change on the Time component

<input type="time" token="field1" searchWhenChanged="true">
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...