Simple xml submit button

[mschellhouse]

The submit button on simple xml seems to have no effect. I have a dropdown that runs a query and sets tokens for earliest/latest based on a selection. Every change in the dropdown reruns the search in subsequent dashboard panel.

Here is a link to the simple xml code (someday I will have enough Karma points to be productive on here)

https://imgur.com/IXw5jzN

[maciep · Accepted solution]

would you be able to use the timeframe token itself in a base search, and then set your tokens once that search is finalized? Not sure how much more trouble that would be, but might be a workaround for now? This way you're actually using the token that should respect the submit button.

Maybe something like this, where the input section is the same as yours minus the change tag. Note, I just typed this out with absolutely no testing so probably won't work as is.

<form>
    <fieldset>
        <input>
        </input>
    </fieldset>
    <search id="set_token">
        <query> | stats count | eval tf=$timeframe$ | rex field=tf "^(?<begin>[^-]+)-(?<end>.+)" | eval begin=strptime(begin,"%m/%d/%y %H:%M:%S"),end=strptime(end,"%m/%d/%y %H:%M:%S") | fields begin, end</query>
        <finalized>
            <set token="tok_earliest">$result.begin$</set>
            <set token="tok_latest">$result.end$</set>
        </finalized>
    </search>
    <row>
        <panel></panel>
    </row>
    .
    .
    .
</form>

---

updated as per feedback for typos.

[mschellhouse]

I am trying to implement this approach and it doesn't seem to set the tokens. Except for one small typo, your logic is solid. Dumping the query into a panel and running does work. Seems like there may be a limitation or some special condition in doing this in a base search?

[mschellhouse]

Changing $row.xxx$ to $result.xxx$ appears to have worked.

[rjthibod]

What you are seeing is a side-effect of what I posted here: https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html

Basically, any token changes inside of the <change> block are immediate regardless of how you set searchWhenChanged. There is no built-in workaround in SimpleXML that doesn't require you changing how you do inputs. The only other option is implement the logic in JavaScript, which is probably overkill.