Dashboards & Visualizations

Simple xml submit button

mschellhouse
Path Finder

The submit button on simple xml seems to have no effect. I have a dropdown that runs a query and sets tokens for earliest/latest based on a selection. Every change in the dropdown reruns the search in subsequent dashboard panel.

Here is a link to the simple xml code (someday I will have enough Karma points to be productive on here)

https://imgur.com/IXw5jzN

0 Karma
1 Solution

maciep
Champion

would you be able to use the timeframe token itself in a base search, and then set your tokens once that search is finalized? Not sure how much more trouble that would be, but might be a workaround for now? This way you're actually using the token that should respect the submit button.

Maybe something like this, where the input section is the same as yours minus the change tag. Note, I just typed this out with absolutely no testing so probably won't work as is.

<form>
    <fieldset>
        <input>
        </input>
    </fieldset>
    <search id="set_token">
        <query> | stats count | eval tf=$timeframe$ | rex field=tf "^(?<begin>[^-]+)-(?<end>.+)" | eval begin=strptime(begin,"%m/%d/%y %H:%M:%S"),end=strptime(end,"%m/%d/%y %H:%M:%S") | fields begin, end</query>
        <finalized>
            <set token="tok_earliest">$result.begin$</set>
            <set token="tok_latest">$result.end$</set>
        </finalized>
    </search>
    <row>
        <panel></panel>
    </row>
    .
    .
    .
</form>

updated as per feedback for typos.

View solution in original post

maciep
Champion

would you be able to use the timeframe token itself in a base search, and then set your tokens once that search is finalized? Not sure how much more trouble that would be, but might be a workaround for now? This way you're actually using the token that should respect the submit button.

Maybe something like this, where the input section is the same as yours minus the change tag. Note, I just typed this out with absolutely no testing so probably won't work as is.

<form>
    <fieldset>
        <input>
        </input>
    </fieldset>
    <search id="set_token">
        <query> | stats count | eval tf=$timeframe$ | rex field=tf "^(?<begin>[^-]+)-(?<end>.+)" | eval begin=strptime(begin,"%m/%d/%y %H:%M:%S"),end=strptime(end,"%m/%d/%y %H:%M:%S") | fields begin, end</query>
        <finalized>
            <set token="tok_earliest">$result.begin$</set>
            <set token="tok_latest">$result.end$</set>
        </finalized>
    </search>
    <row>
        <panel></panel>
    </row>
    .
    .
    .
</form>

updated as per feedback for typos.

mschellhouse
Path Finder

I am trying to implement this approach and it doesn't seem to set the tokens. Except for one small typo, your logic is solid. Dumping the query into a panel and running does work. Seems like there may be a limitation or some special condition in doing this in a base search?

0 Karma

mschellhouse
Path Finder

Changing $row.xxx$ to $result.xxx$ appears to have worked.

rjthibod
Champion

What you are seeing is a side-effect of what I posted here: https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html

Basically, any token changes inside of the <change> block are immediate regardless of how you set searchWhenChanged. There is no built-in workaround in SimpleXML that doesn't require you changing how you do inputs. The only other option is implement the logic in JavaScript, which is probably overkill.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...