Dashboards & Visualizations

Drop down with Saved Search does not respond to time token change and Submit button present

altink
Builder

Dear All

I have a Drop Down (named Database) which loads list of options dynamically via a search initially started in a saved-search, saved top of the form. The form has also a time token input and a Submit button. The saved search is bound to the time token (see code below)
The problem is that when I change the time in the time token - the Drop-Down list of values is not refreshed.

Please see the code below, start of the form to Submit button:

<form>
  <label>Scan Compare 001</label>

  <!-- This limits events passed to post-process search -->
  <search id="vln_base">
    <query>
      `mc_vln`
    </query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>

  <search id="vln_cmp">
    <query>`mc_comp($field_scan_run_id$,$field_scan_bs_id$)`</query>
    <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
  </search>

  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>-30d@d</earliest>
        <latest>now</latest>
      </default>
    </input>

    <input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search base="vln_base">
        <query>DEDUP DB_NAME | FIELDS DB_NAME</query>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_run_id" searchWhenChanged="false">
      <label>Scan Id Run</label>
      <search base="vln_base">
        <query>search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID
| sort - SCAN_DT_START</query>
      </search>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_run_id_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_bs_id" searchWhenChanged="false">
      <label>Scan Id Baseline</label>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_bs_id_no_quotes">$value$</set>
      </change>
      <search base="vln_base">
        <query>
          <![CDATA[          
          search DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID 
| sort - SCAN_DT_START 
]]>
        </query>
      </search>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_cmp_code" searchWhenChanged="true">
      <label>Comparison</label>
      <showClearButton>false</showClearButton>
      <choice value="ALL_NO_FIELD_ALL">ALL</choice>
      <choice value="Unchanged">Changes Only</choice>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>

.......................................................................................................

If I renounce using a saved search in the Database drop down, and use a direct search (see code below)

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search base="vln_base">
        <query>DEDUP DB_NAME | FIELDS DB_NAME</query>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

replaced with

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
    <latest>$field1.latest$</latest>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>
      </change>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

then the Database Drop Down starts responding to changes in token, it reloads the options list each time the time is changed.

Back into the problematic case with saved search - I can have the Database Drop Down reloaded by pressing the Submit button. But I need to have it respond to the Time Picker (token) - the Submit button is needed for later (in form) dashboards.

My question:
Q1. Why the options list search direct VS / saved-search makes a difference on this?
Q2. How can I have this problem fixed by using saved-search in the Drop-Down?

best regards,
Altin

at your disposal for further info/query

0 Karma

altink
Builder

resolved by enabling Search on Change on the Time component

<input type="time" token="field1" searchWhenChanged="true">
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...