Dashboards & Visualizations

searchWhenChanged=false not honored?

Motivator

Hey guys,

I have an issue where searchWhenChanged=false is not being honored. I have a fieldset with 5 inputs all set to false, but occasionally for four of the inputs, those inputs will still execute a search when changed without the submit button being pressed. This only occurs after one initial search has been executed. The fifth input, shown in its entirety here, will execute the search when changed every time without exception.

<input type="text" token="search" searchWhenChanged="false">
  <label>First Last or ID (*'s accepted)</label>
  <default></default>
</input>

I've changed the token name in case $search$ is reserved without any difference. The token $search$ is only being used in an invisible inputs query inside fieldset which generates basically "global variables" for a bunch of different panels in my dashboard.

<input type="dropdown" depends="$justHideMe$">
  <search>
    <query>
index=MY_HR_DATABASE | eval search="$search$" | rex field=search "^(?&lt;first&gt;\S+?)\s+?(?&lt;last&gt;\S+)$|^(?&lt;id&gt;[\s\S]+)$" | REST OF QUERY
    </query>
    <earliest>-24h</earliest>
    <latest>now</latest>
    <finalized>
      <set token="lastfirst">$result.LastFirst$</set>
      <set token="networkid">$result.NetworkId$</set>
      <set token="email">$result.Email$</set>
    </finalized>
  </search>
</input>

However if I move the entire stanza outside of fieldset to just be an ad-hoc query, the same problem occurs. I've viewed multiple SA posts that are very informative regarding this issue like https://answers.splunk.com/answers/679596/what-is-the-expected-behavior-for-submit-button-wh.html and https://answers.splunk.com/answers/681772/adding-evaluated-token-breaks-searchwhenchangedfal.html and https://answers.splunk.com/answers/542126/submit-button-not-passing-tokens.html, but to date I have not been able to implement a fix.

0 Karma
1 Solution

Legend

@nick405060 Interesting issue, while I can't give a fix, following is a workaround that you can try to overcome this "tricky" situation:

Create a hidden text input where the <default> value is set using the token from <change> event handler of actual input. Then use the hidden input's token in the search. This way a dummy dependency of clicking the Submit button will be added to the value set in the dropdown input's token set via change event handler.

Following is the run anywhere example which has

1) Input dropdown with searchWhenChanged="false" and dropdown input form token as $tokDDLogLevel$.
2) Input dropdown's <change> event handler that sets a token $tokLogLevelOnChange$ (for test's simplicity purpose same as dropdown's $value$).
3) A hidden text box input which uses the change event handler token as default value and sets the form level text box input as $tokLogLevelOnSubmit$
4) Creates three panels running same search with $tokDDLogLevel$ (panel 1), $tokLogLevelOnChange$ (panel 2) and $tokLogLevelOnSubmit$ (panel 3).

Panel 2 is used to recreate the issue where token $tokLogLevelOnChange$ is changed immediately on change of dropdown value, without even clicking on Submit button.

and Panel 3 is the solution workaround which set the token value from $tokLogLevelOnChange$ to a hidden text box and runs the search only is Submit button is clicked i.e. $tokLogLevelOnSubmit$ is submitted.

Behavior of 2nd panel when Dropdown is changed (issue)

alt text

Behavior of 3rd panel when Submit button is clicked (workaround)

alt text

<form>
  <label>Default Token on change to be used in Search with searchWhenChanged false</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="tokDDLogLevel" searchWhenChanged="false">
      <label>Select Log Level</label>
      <choice value="INFO">INFO</choice>
      <choice value="ERROR">ERROR</choice>
      <choice value="WARN">WARN</choice>
      <change>
        <set token="tokLogLevelOnChange">$value$</set>
      </change>
    </input>
    <input type="text" token="tokLogLevelOnSubmit" searchWhenChanged="false" depends="$hiddenInputForAddingSubmitDependencyForChangeEventHandler$">
      <default>$tokLogLevelOnChange$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Refreshes only on Submit</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokDDLogLevel$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown Form Input token with <code>searchWhenChanged=false</code>
        </div>
        <div>tokDDLogLevel: <b>$tokDDLogLevel$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes without Submit (ISSUE, second time onward)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnChange$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown <code>change</code> Event Handler Token</div>
        <div>tokLogLevelOnChange: <b>$tokLogLevelOnChange$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes only on Submit (FIX)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnSubmit$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the <code>hidden textbox</code> token set via change event handler token of the dropdown to add Submit Token Model dependency</div>
        <div>$tokLogLevelOnSubmit$: <b>$tokLogLevelOnSubmit$</b>
        </div>
      </html>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Motivator

I am posting another answer to this question as a tl;dr version of @niketnilay's answer. ALL credit goes entirely to him.

<fieldset submitButton="true" autoRun="false">
  <input type="text" searchWhenChanged="false">
    <default></default>
    <change>
      <set token="searchOnChange">$value$</set>
    </change>
  </input>
  <input type="text" token="searchOnSubmit" depends="$justHideMe$">
    <default>$searchOnChange$</default>
  </input>
</fieldset>

Legend

@nick405060, I think what you have posted here is the exact use case I have explained in my example as well. Only difference is that my main input is a dropdown rather than a textbox. Nevertheless, I am glad that finally your issue is resolved! Keep Splunking 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

New Member

HI @nick405060 @niketnilay

I am also facing the same issue that you guys have provided. Before hitting the submit button, it is showing me the corresponding result. Can you please help me? I have tried various solutions which are provided on Splunk QA.

https://answers.splunk.com/answers/742451/searchwhenchangedfalse-not-honored-1.html
https://answers.splunk.com/answers/679596/what-is-the-expected-behavior-for-submit-button-wh.html

My sample code:-

<input type="time" token="Time" searchWhenChanged="false">
  <label>Time Picker</label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="APPLICATION" searchWhenChanged="false">
  <label>APPLICATION</label>
  <choice value="svc-logisticsdm-mlo">svc-logisticsdm-mlo</choice>
  <choice value="svc-logistics-bookings">svc-logistics-bookings</choice>
  <choice value="svc-logix-loms-status-updates">svc-logix-loms-status-updates</choice>
  <choice value="svc-logix-loms-create-order">svc-logix-loms-create-order</choice>
  <choice value="svc-logix-stock-check-uat">svc-logix-stock-check-uat</choice>
  <default>svc-logistics-bookings</default>
  <change>
    <set token="tokLogLevelOnChange">$value$</set>
  </change>
</input>
<input type="text" token="tokLogLevelOnSubmit" searchWhenChanged="false" depends="$justHideMe$">
  <label>searchOnSubmit</label>
  <change>
    <condition value="svc-logistics-bookings">
      <unset token="logisticsdm"></unset>
      <unset token="status-updates"></unset>
      <unset token="create-order"></unset>
      <unset token="stock-check"></unset>
      <set token="bookings"></set>
    </condition>
    <condition value="svc-logix-stock-check-uat">
      <unset token="logisticsdm"></unset>
      <unset token="status-updates"></unset>
      <unset token="create-order"></unset>
      <unset token="bookings"></unset>
      <set token="stock-check"></set>
    </condition>
    <condition value="create-order">
      <unset token="logisticsdm"></unset>
      <unset token="status-updates"></unset>
      <unset token="bookings"></unset>
      <unset token="stock-check"></unset>
      <set token="create-order"></set>
    </condition>
    <condition value="svc-logix-loms-status-updates">
      <unset token="logisticsdm"></unset>
      <unset token="stock-check"></unset>
      <unset token="create-order"></unset>
      <unset token="bookings"></unset>
      <set token="status-updates"></set>
    </condition>
    <condition value="svc-logisticsdm-mlo">
      <unset token="create-order"></unset>
      <unset token="status-updates"></unset>
      <unset token="bookings"></unset>
      <unset token="stock-check"></unset>
      <set token="logisticsdm"></set>
    </condition>
  </change>
  <default>$tokLogLevelOnChange$</default>
</input>

Any kind of help would be appreciated.

0 Karma

Legend

@nick405060 Interesting issue, while I can't give a fix, following is a workaround that you can try to overcome this "tricky" situation:

Create a hidden text input where the <default> value is set using the token from <change> event handler of actual input. Then use the hidden input's token in the search. This way a dummy dependency of clicking the Submit button will be added to the value set in the dropdown input's token set via change event handler.

Following is the run anywhere example which has

1) Input dropdown with searchWhenChanged="false" and dropdown input form token as $tokDDLogLevel$.
2) Input dropdown's <change> event handler that sets a token $tokLogLevelOnChange$ (for test's simplicity purpose same as dropdown's $value$).
3) A hidden text box input which uses the change event handler token as default value and sets the form level text box input as $tokLogLevelOnSubmit$
4) Creates three panels running same search with $tokDDLogLevel$ (panel 1), $tokLogLevelOnChange$ (panel 2) and $tokLogLevelOnSubmit$ (panel 3).

Panel 2 is used to recreate the issue where token $tokLogLevelOnChange$ is changed immediately on change of dropdown value, without even clicking on Submit button.

and Panel 3 is the solution workaround which set the token value from $tokLogLevelOnChange$ to a hidden text box and runs the search only is Submit button is clicked i.e. $tokLogLevelOnSubmit$ is submitted.

Behavior of 2nd panel when Dropdown is changed (issue)

alt text

Behavior of 3rd panel when Submit button is clicked (workaround)

alt text

<form>
  <label>Default Token on change to be used in Search with searchWhenChanged false</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="tokDDLogLevel" searchWhenChanged="false">
      <label>Select Log Level</label>
      <choice value="INFO">INFO</choice>
      <choice value="ERROR">ERROR</choice>
      <choice value="WARN">WARN</choice>
      <change>
        <set token="tokLogLevelOnChange">$value$</set>
      </change>
    </input>
    <input type="text" token="tokLogLevelOnSubmit" searchWhenChanged="false" depends="$hiddenInputForAddingSubmitDependencyForChangeEventHandler$">
      <default>$tokLogLevelOnChange$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Refreshes only on Submit</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokDDLogLevel$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown Form Input token with <code>searchWhenChanged=false</code>
        </div>
        <div>tokDDLogLevel: <b>$tokDDLogLevel$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes without Submit (ISSUE, second time onward)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnChange$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown <code>change</code> Event Handler Token</div>
        <div>tokLogLevelOnChange: <b>$tokLogLevelOnChange$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes only on Submit (FIX)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnSubmit$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the <code>hidden textbox</code> token set via change event handler token of the dropdown to add Submit Token Model dependency</div>
        <div>$tokLogLevelOnSubmit$: <b>$tokLogLevelOnSubmit$</b>
        </div>
      </html>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Motivator

Unfortunately this is not a complete workaround. This code will demonstrate (copy and pasteable):

<form>
  <label>User Activity</label>

  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="tokFormInputTextBox" searchWhenChanged="false">
      <label>First Last or ID (*'s accepted)</label>
      <default></default>
      <change>
        <set token="searchOnChange">$value$</set>
      </change>
    </input>
    <input type="text" token="searchOnSubmit" depends="$justHideMe$">
      <default>$searchOnChange$</default>
    </input>
    <input type="dropdown" token="tokFormInputDropdown">
      <search>
        <query>
| makeresults | eval NetworkId="$searchOnSubmit$" | table NetworkId
            </query>
        <earliest>-24h</earliest>
        <latest>now</latest>
        <done>
          <set token="lastfirst">$result.LastFirst$</set>
          <set token="networkid">$result.NetworkId$</set>
          <set token="email">$result.Email$</set>
        </done>
      </search>
      <fieldForLabel>LastFirst</fieldForLabel>
      <fieldForValue>Email</fieldForValue>
    </input>
    <input type="text" token="networkIDOnSubmit" depends="$justHideMe$">
      <default>$networkid$</default>
    </input>
  </fieldset>

  <row>
    <panel>
      <title>Sessions:</title>
      <table>
        <search>
          <query>
    | makeresults | eval a="$networkIDOnSubmit$" | table a
              </query>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>

</form>

As you can tell, you cannot enter a value in the search box and then press submit. You need to unfocus from the search box, wait a second for it to populate (which you can visually see!), and then press submit (or press submit once, wait a second, and then press it again, but there are some major downsides to this second approach).

How do I fix this so that I can use a search box, conditional/change tokens, and a submit button?

0 Karma

Motivator

I fixed it! I am adding this as a second comment instead of removing the above comment, though, in case you have any interest in exploring why the above situation occurred. I think there are going to be situations where the same thing is going to occur for other users, where they can't implement my fix below? Honestly I am not 100% sure though, this is complicated lol.

Anyways, for ME my fix was just to move the dropdown (originally a hidden dropdown, if you remember) outside of fieldset to be an ad-hoc search. Why I was using a hidden dropdown and not an ad-hoc search to begin with is a long story, but if you remember from the usergroups conversation, I had tried converting to an ad-hoc search many times without any success fixing this issue. Once you so helpfully told me your solution in usergroups (the below solution)

 <input type="text" token="tokFormInputTextBox" searchWhenChanged="false">
   <label>First Last or ID (*'s accepted)</label>
   <default></default>
   <change>
     <set token="searchOnChange">$value$</set>
   </change>
 </input>
 <input type="text" token="searchOnSubmit" depends="$justHideMe$">
   <default>$searchOnChange$</default>
 </input>

then it was able to correctly fix the problem in conjunction with moving the hidden dropdown to an ad-hoc search (plus changing finalized to done, idk if that helped). Thank you once again!!!!!!! 16 aggregate hours later lol

Motivator

Edit: for anyone viewing this, I believe there is another (possible, if not outdated) solution here:

https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!