Dashboards & Visualizations

In the dashboard, how to stop the token from being searched until an input is provided by the users?

Hemnaath
Motivator

Hi,
We have created a dashboard with six panels and two common input field (Text input and Time picker input) using the token to sync the value to all the panels. We could see that all the panels are working fine, but whenever there is no input provided by the user,Splunk still tries to search automatically, which we wanted to stop.
Could anyone guide to fix this issue?

Tags (3)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

Edit the dashboard and check:

  • if the "autorun dashboard" is checked. If so, uncheck it
  • if the inputs "search on change" is checked. if so, uncheck them
  • Add a submit button
------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Edit the dashboard and check:

  • if the "autorun dashboard" is checked. If so, uncheck it
  • if the inputs "search on change" is checked. if so, uncheck them
  • Add a submit button
------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

Hemnaath
Motivator

hey both autorun and search on change is unchecked but still could see this in the dashboard panel
"waiting for data" and after few seconds its changes to no result found.
so could you please guide me on this.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

check my comment on your posted code
also, I've updated my answer

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

Hemnaath
Motivator

hey diogofgm , thanks for your effort on this, I got it. By changing the search on change=false and adding submit button in the panel.

0 Karma

niketn
Legend

@Hemnaath are you seeing Search is waiting for input... in the panels or are the searches actually running with some default values for Time and Text?

Would you be able to share the Simple XML Dashboard code for the two inputs and at least one of the panel where behavior is not as expected? Also if possible share a screenshot of issue from the dashboard.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Hemnaath
Motivator

Hi niketnialy, thanks for your effort on this, please find the below xml detail for the first two panels.

<form>
  <label>Internal-USER-LOOKUP</label>
  <fieldset submitButton="false" autoRun="false">
    <input type="text" token="F" searchWhenChanged="false">
      <label>Username</label>
      <default></default>
    </input>
    <input type="time" token="T" searchWhenChanged="true">
      <label>Time picker input</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>First Name</title>
        <search>
          <query>| inputlookup Internal-IDENTITY-AD.csv  | search identity ="$F$" | table first</query>
          <earliest>$T.earliest$</earliest>
          <latest>$T.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>
        <title>Last Name</title>
        <search>
          <query>| inputlookup Internal-IDENTITY-AD.csv | search identity ="$F$" | table last</query>
          <earliest>$T.earliest$</earliest>
          <latest>$T.latest$</latest>
        </search>
        <option name="drilldown">none</option>
      </single>
    </panel>
    <panel>
      <single>

I am not sure how to attach the screen shot, but I could see "waiting for data .." and after few second it changes to No result found. Kindly guide me on this.

0 Karma

diogofgm
SplunkTrust
SplunkTrust
<input type="time" token="T" searchWhenChanged="true">

you have a search when changed in the time. Also add a submit button.

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

Hemnaath
Motivator

hey by changing the searchwhenchanged=false, when we try to change the username/time input are getting updated in all the panels and we could see no result found or we could see previous input result. Not sure how/where to add the submit button and how to pass the parameter.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...