Splunk Classic Dashboard - Prevent trigger of <change> on first load

[dmoberg]

In my dashboard, when one of the dropdowns are changed I need to reset the value in the other dropdowns to the default value (*); this can easily be done using the <change> function so no issues there. The problem arises when the user clicks a link to the dashboard with pre-populated parameters for the dropdowns (user is taken to a specific state of the dropdowns). The loading of the dashboard with the incoming HTTP parameters for the dropdowns also trigger the <change> to happen and thus resetting all of the selected dropdowns.

My questions is, how can I prevent the <change> to trigger on the Initial Load of the Dashboard? Once the Dashboard has been loaded I want the <change> to trigger when the user changes certain dropdowns.

I tried the following approach. In the dropdown for which I want to prevent the <change> to trigger a condition was added to check that the Token $FirstLoad$ is set to "Done".

<change>
<condition match="tostring($FirstLoad$) == &quot;Done&quot;">
<set token="form.PipelineName">*</set>
<set token="form.LabelName">*</set>
</condition>

In the heaviest Search I set a Token when completed (Done):
<done>
<set token="FirstLoad">Done</set>
</done>

The thinking for the above was that since on Initial Load the $FirstLoad$ Token will not initially be set which should prevent the <change> to trigger, but as soon as the $FirstLoad$ Token is updated to "Done", the <change> is triggered. Very frustrating.

Anyways, maybe I am missing something simple? Any ideas are appreciated.

[dmoberg]

I was able to solve it.

By populating the dropdowns in the Dashboard from an Inputlookup (with data from a scheduled search), it started working to use the approach I detailed below (setting the FirstLoad Token). Not sure exactly why this made it work but at least it works.

[gcusello]

Hi @dmoberg ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[gcusello]

Hi @dmoberg ,

see if this my old answer solves your requirement: https://community.splunk.com/t5/Dashboards-Visualizations/How-to-clear-reset-the-value-of-a-token/td...

Ciao.

Giuseppe

[dmoberg]

@gcusello, thanks but we need this to be automatically happening. It has to be some way to fix this?

[gcusello]

Hi @dmoberg ,

for my knowledge, this is the only solution, no automatic.

Ciao.

Giuseppe