Dashboards & Visualizations

Why is the base search not running at loading time and the optional filter input is not being displayed?

Explorer

We have a dashboard with filters in a <fieldset> configured with autoRun=false, along with a submit button.

Some filters should only be displayed when the current user has a specific role. To find this, I run a base search calling the REST api and I set a token if the user has the role. This token is then used in the depends attribute of the <input>.

My problem is that the first time the dashboard is loaded, the base search is apparently not run and thus the optional filter input is not displayed (although the current user has the needed role). One needs to submit the filters at least once to see the optional filter appear.
How can I overcome this ?

Note : I don't want to use rejects instead of depends as the reverse problem will happen : users without the specific role will see the optional filter until they submit the search.

Here's a code with "power" used as the "trigger" role. The user you're using should inherit the power role in order to reproduce the problem :

<form hideFooter="true">
  <label>Splunk Test</label>
  <description>Splunk Test</description>

    <search id="detectPower">
     <query>| rest splunk_server=local /services/authentication/current-context | table roles 
            | search roles="power"
     </query>
     <done>
       <condition match="$job.resultCount$ > 0">
         <set token="powerUser">true</set>
       </condition>
       <condition>
         <unset token="powerUser"></unset>
       </condition>       
     </done>
   </search>  

  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="tokenTime" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>

    <!-- Only for power users -->
    <input type="dropdown" token="tokenComponent" searchWhenChanged="false" depends="$powerUser$">
      <label>Component</label>
      <choice value="*">All components</choice>
      <search>
        <query>index=_internal | fields component | dedup component | sort component</query>
      </search>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <default>*</default>
    </input>
  </fieldset>

  <row>
    <panel>
      <html><p>powerUser: $powerUser$</p></html>
      <table>
        <search>
          <query>index=_internal component=$tokenComponent$
                 | stats count by log_level</query>
          <earliest>$tokenTime.earliest$</earliest>
          <latest>$tokenTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

We're using Splunk 6.5.5.

0 Karma

Explorer

One possible solution I have found is to enable searchWhenChanged="true" on one of the inputs.

At loading of this page, the data will be fetched and the base search will be run.

This contradicts a bit my requirements, though (data fetching only when the user clicks the submit button).

Is there another solution ? Couldn't some JavaScript force the launch of the base search at loading time instead ?

0 Karma

Champion

seems to work on my free 7.0.1 license...had to change the role search to admin since there are no users in the free version, but the input displayed as expected. And when i changed the role search to something else, the dropdown didn't display.

0 Karma

Explorer

@maciep: I've just tried with a docker image of Splunk 7.0.2 and I kept having the same problem.
I created a user with only the "power" role, I opened the dashboard, I couldn't see the "Component" dropdown.
I clicked on Submit, the dropdown appeared.

0 Karma

Champion

ok, maybe i didn't test it fully enough. I don't think i ever left the dashboard and came back to it...just updated the xml, saved and refreshed.

I do see similar behavior on 6.5.2 as well

0 Karma