Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: How can I make the first tab autorun the first...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am following the instructions from here
https://www.splunk.com/blog/2015/03/30/making-a-dashboard-with-tabs-and-searches-that-run-when-click...
And while I have tabs working (and like the fact searches won't trigger until you click the appropriate tab), I have the issue of that first tab when you load the dashboard waiting in the "Search is waiting for input... " message forever. My tabs are a visual dashboard that requires no input, so I don't need my consumer to submit anything or press any button. If I click on a different tab and come back to the first one, the search then runs. How can I make it so the searches in the first tab run automatically when you load the dashboard?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to initialize your tokens - set desired tab token and unset the rest.
Add this right after your title.
<init>
<set token="siar">SIAR</set>
<unset token="psirt"/>
</init>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to initialize your tokens - set desired tab token and unset the rest.
Add this right after your title.
<init>
<set token="siar">SIAR</set>
<unset token="psirt"/>
</init>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I would check your token names, as the "Search is waiting for input... " is sometimes a symptom of a misspelled token in the search.
Is there something that's set in the 2nd tab that's used in the 1st?
HTH, Keith
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't think this would be the case since I'm using only the tokens to have the tab feature work. Also the searches on both tabs are independent. see below
<form script="tabs.js" stylesheet="tabs.css">
<label>TITLE</label>
<row id="tabs">
<panel>
<html>
<ul id="tabs" class="nav nav-tabs">
<li class="active">
<a href="#" class="toggle-tab" data-toggle="tab" data-elements="siar_summary" data-token="siar">SIAR</a>
</li>
<li>
<a href="#" class="toggle-tab" data-toggle="tab" data-elements="psirt_summary" data-token="psirt">PSIRT</a>
</li>
</ul>
</html>
</panel>
</row>
<row id="siar_summary">
<panel>
<title>SIAR</title>
<table>
<search>
<query>index=idx-np $siar$ sourcetype=track_members trackFlexibleCompliant=False [search sourcetype=group_members_v5 groupId=1234 | fields deviceId] | stats count as Total | eval divisionName="Division A" | table divisionName,Total</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
<row id="psirt_summary">
<panel>
<title>PSIRT</title>
<table>
<search>
<query>index=idx-np sourcetype=track_members trackFlexibleCompliant=False $psirt$ [search sourcetype=group_members_v5 groupId=5678 | fields deviceId] | stats count as Total | eval divisionName="Division B" | table divisionName,Total</query>
<earliest>@d</earliest>
<latest>now</latest>
</search>
</table>
</panel>
</row>
</form>
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
