I have created a dashboard that takes input from the users in 4 textbox inputs and store it in a lookup file.
My requirement is that tokens should be passed to the search query only after submit button is clicked by user. But submit button is not working as per expectation. Sometimes query is executing automatically when we click outside the text boxes or it is executing when the page is reloaded.
My second requirement is to clear the textbox once submit button is clicked.
I searched the community for similar questions ,made changes in the code as suggested but it is not working. Thanks in advance.
<fieldset submitButton="true" autoRun="false">
<input type="text" token="usecasename" searchWhenChanged="false">
<label>Enter UseCaseName Here</label>
</input>
<input type="text" token="error" searchWhenChanged="false">
<label>Enter Error/Exception here</label>
</input>
<input type="text" token="impact" searchWhenChanged="false">
<label>Enter Impact here</label>
</input>
<input type="text" token="reason" searchWhenChanged="false">
<label>Enter Reason here</label>
</input>
</fieldset>
<row depends="$hide$">
<panel>
<table>
<title></title>
<search>
<query>| stats count| fields - count|eval useCaseName="$usecasename$", "Error/Exception in logs"="$error$", Impact="$impact$", Reason="$reason$"|append[| inputlookup lookup_exceptions_all_usecase1.csv]| outputlookup lookup_exceptions_all_usecase1.csv</query>
<earliest>-24h</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
4
Not sure why you are seeing it executing randomly - that does not seem right - can you produce a test case.
However, I use this regularly for updating lookups - all you need to do it reset the tokens following the end of the search that writes the lookup. See the <done> section below. Unsetting the form.* tokens will remove the inputs from the display and removing the non-form tokens will prevent the search from running until all 4 of the tokens are input.
Note in the <search> below, I did it slightly differently using makeresults, so there is a _time field which is when the search runs. It will add the new data to the END of the lookup, so that may not be useful for you.
Note that when using append=t the _time field will not get added to the existing lookup if it does not already exist.
<form version="1.1" theme="light">
<label>tmp3</label>
<description>Replicate time picker issue</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="usecasename" searchWhenChanged="false">
<label>Enter UseCaseName Here</label>
</input>
<input type="text" token="error" searchWhenChanged="false">
<label>Enter Error/Exception here</label>
</input>
<input type="text" token="impact" searchWhenChanged="false">
<label>Enter Impact here</label>
</input>
<input type="text" token="reason" searchWhenChanged="false">
<label>Enter Reason here</label>
</input>
</fieldset>
<row depends="$hide$">
<panel>
<table>
<title></title>
<search>
<query>
| makeresults
| eval useCaseName="$usecasename$", "Error/Exception in logs"="$error$", Impact="$impact$", Reason="$reason$"
| outputlookup append=t lookup_exceptions_all_usecase1.csv
</query>
<earliest>-24h</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
<done>
<unset token="usecasename"></unset>
<unset token="error"></unset>
<unset token="impact"></unset>
<unset token="reason"></unset>
<unset token="form.usecasename"></unset>
<unset token="form.error"></unset>
<unset token="form.impact"></unset>
<unset token="form.reason"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Thank you @bowesmana
Its working perfectly after adding the <done> section shared by you in the response.
Not sure why you are seeing it executing randomly - that does not seem right - can you produce a test case.
However, I use this regularly for updating lookups - all you need to do it reset the tokens following the end of the search that writes the lookup. See the <done> section below. Unsetting the form.* tokens will remove the inputs from the display and removing the non-form tokens will prevent the search from running until all 4 of the tokens are input.
Note in the <search> below, I did it slightly differently using makeresults, so there is a _time field which is when the search runs. It will add the new data to the END of the lookup, so that may not be useful for you.
Note that when using append=t the _time field will not get added to the existing lookup if it does not already exist.
<form version="1.1" theme="light">
<label>tmp3</label>
<description>Replicate time picker issue</description>
<fieldset submitButton="true" autoRun="false">
<input type="text" token="usecasename" searchWhenChanged="false">
<label>Enter UseCaseName Here</label>
</input>
<input type="text" token="error" searchWhenChanged="false">
<label>Enter Error/Exception here</label>
</input>
<input type="text" token="impact" searchWhenChanged="false">
<label>Enter Impact here</label>
</input>
<input type="text" token="reason" searchWhenChanged="false">
<label>Enter Reason here</label>
</input>
</fieldset>
<row depends="$hide$">
<panel>
<table>
<title></title>
<search>
<query>
| makeresults
| eval useCaseName="$usecasename$", "Error/Exception in logs"="$error$", Impact="$impact$", Reason="$reason$"
| outputlookup append=t lookup_exceptions_all_usecase1.csv
</query>
<earliest>-24h</earliest>
<latest></latest>
<sampleRatio>1</sampleRatio>
<done>
<unset token="usecasename"></unset>
<unset token="error"></unset>
<unset token="impact"></unset>
<unset token="reason"></unset>
<unset token="form.usecasename"></unset>
<unset token="form.error"></unset>
<unset token="form.impact"></unset>
<unset token="form.reason"></unset>
</done>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Hi @poojak2579 ,
the Submit button was created to run the dashboard search not to accept a value to store in a lookup.
If you want to accect a value and store it in a lookup, you have to use an HTML button and an external JS containing the outputlookup search.
This is a sample of this I shared some time ago:
Ciao.
Giuseppe
Thanks for the response @gcusello
I will try the HTML button and an external JS approach shared in the link.
Hi @poojak2579 ,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated by all the contributors 😉