Why does the <fields> tag for a table not work properly when associated with a token?

[andrewtrobec]

Hello!

I'm using Splunk 7.3.2 (also tried on 7.2.5.1 and 7.2.6).

I'm replicating the Excel hide/show column feature for Splunk tables, and I am using the fields tag to do it.  By associating the fields value with a token I should technically be able to hide and show table fields for already loaded data rather than having it specify which table fields (| table $tok_fields$) therefore forcing the search to re-run.  I've managed to get it working but it is very unreliable.  Here is a run-anywhere dashboard:

<form>
  <init>
    <set token="tok_fields">["source"]</set>
  </init>
  <label>Hide Table Fields</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tok_show_user">
      <label></label>
      <choice value="*">Show user</choice>
      <change>
        <eval token="tok_fields">if($tok_show_user$="*","[\"source\",\"user\"]","[\"source\"]")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal
| head 10
| table source user</query>
          <earliest>-10min@min</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <fields>$tok_fields$</fields>
      </table>
    </panel>
  </row>
</form>

Now when you save it, it may or may not work.  What I have noticed is that it works in edit mode, so if you load the dashboard, go into edit mode, then cancel edit mode, it'll continue to work until the dashboard is reloaded.  If, on the other hand, you make a change to the dashboard and save, then Splunk decides to hardcode the fields value meaning you have to go back and replace it with the token again.

How can I make this work reliably?  Did I stumble across a bug?

Thanks!

Andrew

[richgalloway]

I can replicate your results in 8.0.4.  In addition, the token debugger shows the token is still there and the value changes to "["source"]" when the checkbox is cleared.  I suggest filing a bug with Splunk Support.

[andrewtrobec]

@richgalloway Thanks for the feedback, so it's not just me!  How do I open a bug?  Is there some sort of flag here in the forum that I can use to highlight the thread?

[richgalloway]

Go to the Splunk Support portal to submit a bug report.  You'll need an entitlement to do that.  You may have to find someone in your org who has an entitlement to file the bug for you.

It may be a moot point, however, as @niketn appears to have solved the problem.

[niketn]

@andrewtrobec you will have to ensure that table re-renders with the new setting each time token changes, which can be done only via JS. The approach that you are using renders the table with initial fields settings but does not change afterward as the table render remains the same.  As an alternative you can control fields directly via SPL if you want to keep changes to Simple XML.

Following is a run anywhere example based on code provided by you.

<form>
  <label>Show fields in table</label>
  <init>
    <set token="tok_fields">"source"</set>
  </init>
  <search id="bSearch">
    <query>index=_internal
| stats count by source user
| sort - count
| head 10
    </query>
    <earliest>-1h</earliest>
    <latest>now</latest>
    <sampleRatio>1</sampleRatio>
  </search>
  <fieldset submitButton="false">
    <input type="checkbox" token="tok_show_user">
      <label></label>
      <choice value="*">Show user</choice>
      <change>
        <eval token="tok_fields">if($tok_show_user$="*","\"source\",\"user\"","\"source\"")</eval>
        <unset token="tokReload"></unset>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search base="bSearch">
          <query>| fields $tok_fields$</query>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

[andrewtrobec]

@niketn Thanks for the reply!  This was my other option which is less elegant since you see the table refresh.  So is it correct that the table does not update by updating the fields tag for the table?  I mean, you can update, for example, a single value's caption using tokens and it works consistently, so are we sure that it's not a bug that the table doesn't update?  Here is run-anywhere dash for showing the single caption:

<form>
  <init>
    <set token="tok_caption">init text</set>
  </init>
  <label>Hide Table Fields</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tok_change_text">
      <label></label>
      <choice value="y">Change text</choice>
      <change>
        <eval token="tok_caption">if($tok_change_text$="y","checkbox text","init text")</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <search>
          <query>index=_internal
| stats count</query>
          <earliest>-10min@min</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="drilldown">none</option>
        <option name="underLabel">$tok_caption$</option>
      </single>
    </panel>
  </row>
</form>

[niketn]

@andrewtrobec understand the rendering as the format for the table. For example the Range Colors that need to be applied on the table cells. Even when the data changes, the cell values will still render based on the range colors already defined in the table format renderer. If you need to change it every time based on event like on click token change in your case, then you can handle the same in JS. There could be something like the following past answer of mine that can be used. You may have to change it to set refresh token that refreshes the SPL as well after renderer change so that content gets updated. https://community.splunk.com/t5/Dashboards-Visualizations/How-to-add-css-class-to-table-field-by-inp...

For the SPL based approach if you do not want to show reload time (re-run of SPL), you can try post processing as in my example.

Finally if above options seem too much round about, you can definitely reach out to support to see if this can be fixed.