Dashboards & Visualizations

When I change the dropdown value and press submit button it does not run the new search

vravisplunker
Explorer

Hi Splunkers,
I'm new to Splunk, need help in understanding submit button behaviour.
Requirement :
Choose respective dropdown values(input) and click the submit button to execute the search(works only for the first time)

Issue: after the first search, I change the drop-down values to something else and when I click the submit button, the search does not re-run for newly changed dropdown values.
I have disabled "searchonchange" checkbox for the submit button to work.
please help!!

Thanks in advance,
Buddingsplunker

0 Karma
1 Solution

gcusello
Legend

Hi vravisplunker,
let me understand:
you have some filters and the active submit Button (option submitButton="true");
you click on it and your search is executed only the first time, then if you click again search isn't executed;
Is it correct?
if you modify one parameter and click on Submit Button, is search executed?

The normal behaviour is that search is newly executed only when al least one parameter is changed, to re execute all the searches in a dashboard you have to reload dashboard or click on the Refresh button of each panel.

Bye.
Giuseppe

View solution in original post

gcusello
Legend

Hi vravisplunker,
let me understand:
you have some filters and the active submit Button (option submitButton="true");
you click on it and your search is executed only the first time, then if you click again search isn't executed;
Is it correct?
if you modify one parameter and click on Submit Button, is search executed?

The normal behaviour is that search is newly executed only when al least one parameter is changed, to re execute all the searches in a dashboard you have to reload dashboard or click on the Refresh button of each panel.

Bye.
Giuseppe

vravisplunker
Explorer

Hi Cusello,
Thanks for your inputs, to answer your question
"if you modify one parameter and click on Submit Button, is search executed?" : No, it does not. is there something I must implement for "reload dashboard or click on the Refresh button of each panel." to re-run the search.

thanks in advance.

0 Karma

gcusello
Legend

Hi vravisplunker,
you could autorefresh your dashboard every minute or a different time period, but it's a different thing.
Anyway to reload dashboard or to re run each search are almost the same thing.
Otherwise you could use real time searches that are always updated.
Be careful not to exaggerate with real time searches because they are heavy for the system!
Bye.
Giuseppe

0 Karma

vravisplunker
Explorer

Hi Giuseppe,
Thanks for your inputs, could you please assist me in understanding why the submit button does not re-run the search upon modification of one or more parameters.
Thanks in advance,
vravisplunker
heres my partial code below:

<form>  
 <label>Test_me</label>  
  <description>Splunk</description>  
  <fieldset submitButton="true" autoRun="false">
           <input type="dropdown" token="trackingparam1" searchWhenChanged="false">
           <label>Choose Tracking Parameter 1</label>
           <search>
             <query>some query to pupulate the drop down</query>
           </search>
           <fieldForLabel>column</fieldForLabel>
           <fieldForValue>column</fieldForValue>
           <choice value="All">All</choice>
           <change>
             <unset token="form.trackingval1"></unset>
             <condition value="All">
               <set token="queryString"></set>
             </condition>
             <condition>
               <set token="queryString">$trackingparam1$="All"</set>
             </condition>
           </change>
           <default>All</default>
           <initialValue>All</initialValue>
         </input>
         <input type="dropdown" token="trackingval1" searchWhenChanged="false">
           <label>Enter Parameter Value 1</label>
           <fieldForLabel>Choose Tracking Parameter 1</fieldForLabel>
           <fieldForValue>$trackingparam1$</fieldForValue>
           <change>
             <condition>
             **<set token="queryString">$trackingparam1$="$trackingval1$"</set>**(need to execute this upon dropdown selection rather than change)
           </condition>
           </change>
           <search>
             <query>index=some query to pupulate the dropdown</query>
           </search>
           <choice value="*">All</choice>
         </input>   </fieldset>  <row>
         <panel>
           <title>Transactions</title>
           <table>
             <search>
               <query>index="test"  Source="$field$" $queryString$|table TransactionId Name Source Target Status Details
     _time</query>
               <earliest>$field6.earliest$</earliest>
               <latest>$field6.latest$</latest>
             </search>
             <option name="drilldown">row</option>
             <!-- disable the search option for results -->
             <option name="link.openSearch.visible">0</option>
             <option name="rowNumbers">true</option>
             <format type="color" field="Status">
               <colorPalette type="map">{"Success":#65A637,"Error":#D93F3C}</colorPalette>
             </format>
             <fields>["Name","Source","Target","Status","Details","_time"]</fields>
             <!-- src_tranid is the field to be drilled down on -->
             <drilldown>
               <set token="src_tranid">$row.TransactionId$</set>
               <set token="src_date">$row.CreatedAt.$date$</set>
             </drilldown>
           </table>
         </panel>
 </row> 
 </form>
0 Karma

gcusello
Legend

Hi vravisplunker,
The only difference I have is that I haven't autoRun="true".
In addition I haven't searchWhenChanged="false" but it's not relevant because this is the default value.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...