Dashboards & Visualizations

Simple XML: How to keep dashboard from auto running


I've seen quite a few posts about this topic but no answers. I have some simple xml dashboards with imbedded searches, and a time picker but I only want the search to run when the user actually clicks the submit button after choosing from the time picker. Currently the searches automatically run onload is there a way to stop this behavior? setting autoRun="false" does not work.


I set fieldset submitButton=false", set the inputs to searchWhenChanged="false".
I added a checkbox: token="Done" searchWhenChanged="true"; no label; value=""; and made the visible choice: Go.
So the user sees a checkbox whose only choice is "Go". It replaces the submit button.
At the beginning of the search, I placed this variable: $Done$.
So when another form submits to this page, Done doesn't exist, and the form waits for the user to check the Go option: the only option.
When the user clicks the checkbox, Done exists as the empty string; so, it does not interfere with the search and the search can proceed.
If the user clicks the checkbox again, unchecking it, Done does not exist, so, nothing happens.
[If the user clicks the checkbox yet again, setting it a second time, the action will occur.]


In addition to this:

<fieldset autorun="false" submitButton="true">

Make sure if you have input fields that you have the searchWhenChanged="false" tag set on each of them:

<input type="dropdown" token="source_ip" searchWhenChanged="false">


I am stuck with same issue, unfortunately your solution doesn't work for us. It looks like autorun="false" is overriden if we have search that is populating dropdown choices. I know that search that is populating dropdown should start with autorun, but the others shouldn't. Is there any usefull workaround for this issue?


I don't understand why this solution doesn't work for you. It's simple and it works with every dashboard I used it on. Please post your code so we can try to determine why it doesn't work.

0 Karma


This worked after I cleared my browser cache.

0 Karma


I don't know what you did that prevents it from working but, here is an example dashboard which does exactly what you want. The searches won't run until you click on the Submit button. Each panel shows message "Search is waiting for input..."

Just replace the terms of the search with something that will find data.

  <fieldset autorun="0" submitButton="true">
    <input type="time" token="time_tok">
        <searchString>index=np_db source="dbmon-tail://SPLUNK_PRD/get_account_detail"</searchString>
        <title>get account details</title>
        <searchString>index=np_db source="dbmon-tail://SPLUNK_PRD/get_account_detail" | timechart span=10m values(AVG_TOTAL_TIME_PER_CALL)</searchString>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
0 Karma


I found another question that answers how to band-aid the issue by adding a form input requirement in the query that really does nothing. http://answers.splunk.com/answers/129853/splunk-6-form-search-query-is-running-on-form-load.html. But that doesn't really answer why autoRun="false" does not a stop searches from automatically running onload. Anyone know?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...