Dashboards & Visualizations

Submit button functionality not working

poojak2579
Path Finder

I have created a dashboard that takes input from the users in 4 textbox inputs and store it in a lookup file.
My requirement is that tokens should be passed to the search query only after submit button is clicked by user. But submit button is not working as per expectation. Sometimes query is executing automatically when we click outside the text boxes or it is executing when the page is reloaded. 
My second requirement is to clear the textbox once submit button is clicked.
I  searched the community for similar questions ,made changes in  the code as suggested but it is not working. Thanks in advance.

 

 <fieldset submitButton="true" autoRun="false">
    <input type="text" token="usecasename" searchWhenChanged="false">
      <label>Enter UseCaseName Here</label>
         </input>
    
    <input type="text" token="error" searchWhenChanged="false">
      <label>Enter Error/Exception here</label>
    </input>
    <input type="text" token="impact" searchWhenChanged="false">
      <label>Enter Impact here</label>
    </input>
    <input type="text" token="reason" searchWhenChanged="false">
      <label>Enter Reason here</label>
    </input>
     
  </fieldset>
  <row depends="$hide$">
    <panel>
      <table>
        <title></title>
        <search>
          <query>| stats count| fields - count|eval useCaseName="$usecasename$", "Error/Exception in logs"="$error$", Impact="$impact$", Reason="$reason$"|append[| inputlookup lookup_exceptions_all_usecase1.csv]| outputlookup lookup_exceptions_all_usecase1.csv</query>
          <earliest>-24h</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>

 

4

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Not sure why you are seeing it executing randomly - that does not seem right - can you produce a test case.

However, I use this regularly for updating lookups - all you need to do it reset the tokens following the end of the search that writes the lookup. See the <done> section below. Unsetting the form.* tokens will remove the inputs from the display and removing the non-form tokens will prevent the search from running until all 4 of the tokens are input.

Note in the <search> below, I did it slightly differently using makeresults, so there is a _time field which is when the search runs. It will add the new data to the END of the lookup, so that may not be useful for you.

Note that when using append=t the _time field will not get added to the existing lookup if it does not already exist.

<form version="1.1" theme="light">
  <label>tmp3</label>
  <description>Replicate time picker issue</description>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="usecasename" searchWhenChanged="false">
      <label>Enter UseCaseName Here</label>
    </input>
    <input type="text" token="error" searchWhenChanged="false">
      <label>Enter Error/Exception here</label>
    </input>
    <input type="text" token="impact" searchWhenChanged="false">
      <label>Enter Impact here</label>
    </input>
    <input type="text" token="reason" searchWhenChanged="false">
      <label>Enter Reason here</label>
    </input>
  </fieldset>
  <row depends="$hide$">
    <panel>
      <table>
        <title></title>
        <search>
          <query>
| makeresults
| eval useCaseName="$usecasename$", "Error/Exception in logs"="$error$", Impact="$impact$", Reason="$reason$"
| outputlookup append=t lookup_exceptions_all_usecase1.csv
          </query>
          <earliest>-24h</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <unset token="usecasename"></unset>
            <unset token="error"></unset>
            <unset token="impact"></unset>
            <unset token="reason"></unset>
            <unset token="form.usecasename"></unset>
            <unset token="form.error"></unset>
            <unset token="form.impact"></unset>
            <unset token="form.reason"></unset>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

View solution in original post

poojak2579
Path Finder

Thank you @bowesmana 
Its working perfectly  after adding the <done> section shared by you in the response.

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Not sure why you are seeing it executing randomly - that does not seem right - can you produce a test case.

However, I use this regularly for updating lookups - all you need to do it reset the tokens following the end of the search that writes the lookup. See the <done> section below. Unsetting the form.* tokens will remove the inputs from the display and removing the non-form tokens will prevent the search from running until all 4 of the tokens are input.

Note in the <search> below, I did it slightly differently using makeresults, so there is a _time field which is when the search runs. It will add the new data to the END of the lookup, so that may not be useful for you.

Note that when using append=t the _time field will not get added to the existing lookup if it does not already exist.

<form version="1.1" theme="light">
  <label>tmp3</label>
  <description>Replicate time picker issue</description>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="usecasename" searchWhenChanged="false">
      <label>Enter UseCaseName Here</label>
    </input>
    <input type="text" token="error" searchWhenChanged="false">
      <label>Enter Error/Exception here</label>
    </input>
    <input type="text" token="impact" searchWhenChanged="false">
      <label>Enter Impact here</label>
    </input>
    <input type="text" token="reason" searchWhenChanged="false">
      <label>Enter Reason here</label>
    </input>
  </fieldset>
  <row depends="$hide$">
    <panel>
      <table>
        <title></title>
        <search>
          <query>
| makeresults
| eval useCaseName="$usecasename$", "Error/Exception in logs"="$error$", Impact="$impact$", Reason="$reason$"
| outputlookup append=t lookup_exceptions_all_usecase1.csv
          </query>
          <earliest>-24h</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <unset token="usecasename"></unset>
            <unset token="error"></unset>
            <unset token="impact"></unset>
            <unset token="reason"></unset>
            <unset token="form.usecasename"></unset>
            <unset token="form.error"></unset>
            <unset token="form.impact"></unset>
            <unset token="form.reason"></unset>
          </done>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

gcusello
SplunkTrust
SplunkTrust

Hi @poojak2579 ,

the Submit button was created to run the dashboard search not to accept a value to store in a lookup.

If you want to accect a value and store it in a lookup, you have to use an HTML button and an external JS containing the outputlookup search.

This is a sample of this I shared some time ago:

https://community.splunk.com/t5/Dashboards-Visualizations/Dynamically-Update-a-lookup-file-on-click-...

Ciao.

Giuseppe

poojak2579
Path Finder

Thanks for the response @gcusello 
 I will try the HTML button and an external JS approach shared in the link.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @poojak2579 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...