Dashboards & Visualizations

Drop down with Saved Search does not respond to time token change and Submit button present

altink
Builder

Dear All

I have a Drop Down (named Database) which loads list of options dynamically via a search initially started in a saved-search, saved top of the form. The form has also a time token input and a Submit button. The saved search is bound to the time token (see code below)
The problem is that when I change the time in the time token - the Drop-Down list of values is not refreshed.

Please see the code below, start of the form to Submit button:

<form>
  <label>Scan Compare 001</label>

  <!-- This limits events passed to post-process search -->
  <search id="vln_base">
    <query>
      `mc_vln`
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>

  <search id="vln_cmp">
    <query>`mc_comp($field_scan_run_id$,$field_scan_bs_id$)`</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>

  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>

    <input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search base="vln_base">
        <query>DEDUP DB_NAME | FIELDS DB_NAME</query>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_run_id" searchWhenChanged="false">
      <label>Scan Id Run</label>
      <search base="vln_base">
        <query>search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID
| sort - SCAN_DT_START</query>
      </search>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_run_id_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_bs_id" searchWhenChanged="false">
      <label>Scan Id Baseline</label>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_bs_id_no_quotes">$value$</set>
      </change>
      <search base="vln_base">
        <query>
          <![CDATA[          
          search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID 
| sort - SCAN_DT_START 
]]>
        </query>
      </search>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_cmp_code" searchWhenChanged="true">
      <label>Comparison</label>
      <showClearButton>false</showClearButton>
      <choice value="ALL_NO_FIELD_ALL">ALL</choice>
      <choice value="Unchanged">Changes Only</choice>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>

.......................................................................................................

If I renounce using a saved search in the Database drop down, and use a direct search (see code below)

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search base="vln_base">
        <query>DEDUP DB_NAME | FIELDS DB_NAME</query>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

replaced with

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

then the Database Drop Down starts responding to changes in token, it reloads the options list each time the time is changed.

Back into the problematic case with saved search - I can have the Database Drop Down reloaded by pressing the Submit button. But I need to have it respond to the Time Picker (token) - the Submit button is needed for later (in form) dashboards.

My question:
Q1. Why the options list search direct VS / saved-search makes a difference on this?
Q2. How can I have this problem fixed by using saved-search in the Drop-Down?

best regards,
Altin

at your disposal for further info/query

0 Karma

altink
Builder

resolved by enabling Search on Change on the Time component

<input type="time" token="field1" searchWhenChanged="true">
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...