Developing for Splunk Enterprise

What is the expected behavior for Submit button when inputs have searchWhenChanged=false

niketnilay
Legend

Expected behavior for Submit button in Simple XML Dashboard is to prevent Input changes to be reflected until Submit button is clicked, provided searchWhenChanged for the input/s is/are set to false and they do not have their <change> event handlers defined.

However, when I tested small piece of run anywhere example in 6.6.3 and 7.1.2, Submit button does not seem to enforce the right effect. Whenever input was changed the tokens got the updated values even before clicking on the Submit button. (PS: I also tested for radio input but have not added the code for keeping the example simple).

<form>
  <label>Submit Button Obsolete</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="tokPanel" searchWhenChanged="false">
      <label></label>
      <choice value="1">One</choice>
      <choice value="2">Two</choice>
      <default>1</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="false">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>form.tokPanel- $form.tokPanel$</div>
        <div>form.tokTime- $form.tokTime.earliest$,$form.tokTime.latest$</div>
        <div>tokPanel- $tokPanel$</div>
        <div>tokTime- $tokTime.earliest$,$tokTime.latest$</div>
      </html>
    </panel>
  </row>
</form>

Requesting Splunk Team to confirm if the Submit button is truly obsolete or not. If so, it would be better to remove Submit button as Input option.
(PS: An <html> <button> would be a better feature for Dashboard, if the same can be provided ;))

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

woodcock
Esteemed Legend

The simpleXML submit button is horribly broken and for complex usecases, cannot be made to work.  Try this dahsboard's no-JavaScript approach instead:

 

<form theme="dark">
  <label>PoC demonstrating a fully-functioning no-JS SUBMIT "button" (actually "checkbox").</label>
  <description>https://community.splunk.com/t5/Dashboards-Visualizations/SimpleXML-Inherent-brokenness-regarding-autorun-and-Submit/m-p/407351  For intricate technical reasons that Splunk considers "working as intended", the "real" SUBMIT button is fundamentally broken and CANNOT BE MADE TO WORK for many usecases (i.e. when you must use "true" for "searchWhenChanged").  Fortunately, the method demonstrated herein does everything that anyone could desire with only 1 downside which is this: there is no way to make the dashboard autorun on first load (not even if you click the CHECKBOX with a URI in the URL).  Notice that even though some of the controls interact with one-another, the actual search does not run until the SUBMIT box is checked.  Here are the pieces that are required. 1: DO NOT CHANGE ANYTHING ABOUT THE "SUBMIT" checkbox other than cosmetic things (e.g. html).  2: Ensure that EVERY OTHER CONTROL has a "&lt;change&gt;...&lt;/change&gt;" section that unsets BOTH these tokens: {"SUBMIT_CHECKBOX", "form.SUBMIT_CHECKBOX"}.  3: Ensure that 1 search in every chain of searches uses the do-nothing "$SUBMIT_CHECKBOX$" token somewhere (i.e. if all searches are driven by a base search, this only has to be done in the base search, not the post-process searches).  This token will always be either unset or blank so it does not matter where you put it.  4: Neither the individual "searchWhenChanged" values of the controls NOR the global "Autorun dashboard" value makes any difference.  For support contact woodcock@splunxter.com.</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="INDEX" searchWhenChanged="true">
      <label>Select Index value(s)</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <default>*</default>
      <search>
        <query>|tstats count dc(host) WHERE index=* AND $SOURCETYPE$ BY index
| rename index AS value
| eval label = value
| append [|makeresults | eval label = "All", value="*"]
| table label value</query>
        <earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>
      </search>
      <delimiter> OR index=</delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <prefix>(index=</prefix>
      <change>
        <eval token="form.INDEX">case(mvcount($form.INDEX$) == 2 AND mvindex($form.INDEX$, 0) == "*", mvindex($form.INDEX$, 1), mvfind($form.INDEX$, "^[*]") == mvcount($form.INDEX$) - 1, "*", true(), $form.INDEX$)</eval>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
      <suffix>)</suffix>
    </input>
    <input type="multiselect" token="SOURCETYPE" searchWhenChanged="true">
      <label>Select sourcetype value(s)</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <default>*</default>
      <search>
        <query>|tstats count dc(host) WHERE $INDEX$ AND sourcetype=* BY sourcetype
| rename sourcetype AS value
| eval label = value
| append [|makeresults | eval label = "All", value="*"] 
| table label value</query>
        <earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>
      </search>
      <delimiter> OR sourcetype=</delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <prefix>(sourcetype=</prefix>
      <change>
        <eval token="form.SOURCETYPE">case(mvcount($form.SOURCETYPE$) == 2 AND mvindex($form.SOURCETYPE$, 0) == "*", mvindex($form.SOURCETYPE$, 1), mvfind($form.SOURCETYPE$, "^[*]") == mvcount($form.SOURCETYPE$) - 1, "*", true(), $form.SOURCETYPE$)</eval>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
      <suffix>)</suffix>
    </input>
    <input type="text" token="COUNT">
      <label>Name for "count" field</label>
      <default>count</default>
      <change>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
    </input>
    <input type="time" token="timepicker" searchWhenChanged="true">
      <label>Timepicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
    </input>
    <input id="submit_checkbox" type="checkbox" token="SUBMIT_CHECKBOX">
      <label></label>
      <delimiter> </delimiter>
      <choice value="">SUBMIT</choice>
    </input>
    <html depends="$hide$">
      <style>
        #submit_checkbox{
          width:80px !important;
        }
        #submit_checkbox
div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
          width:80px !important;
        }
        #submit_checkbox  button{
          padding: 6px 15px !important;
          border-radius: 3px !important;
          font-weight: 500 !important;
          background-color: #5cc05c !important;
          border: transparent !important;
          color: #fff !important
        }
        #submit_checkbox  button:hover{
          background-color: #40a540 !important;
          border-color: transparent !important;
        }
    </style>
  </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Searches ONLY on checking the SUBMIT box (which resets itself)</title>
        <search>
          <query>|tstats count AS $COUNT|s$ dc(host) WHERE $INDEX$ AND $SOURCETYPE$ BY index sourcetype $SUBMIT_CHECKBOX$</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

0 Karma

niketnilay
Legend

Thanks to @snayak_splunk and @rjthibod, this functionality as working as expected. The issue was with my understanding of Submitted Token Model And Default Token Models.

In use cases like the one mentioned in the question, where Submit Button is used and <input>s have searchWhenChanged set to false and also no <change> Event Handler defined, the default token model will get the changed value but submitted token model will not get the changed value until Submit button is clicked.

While value Default Token Model is used to display in <html> panel, value of Submitted Token Model is used to display in <search> result.

With the help of Developer Gadgets app built by Ryan, I was able to test and confirm this expected behavior.

alt text

Refer to following Run Anywhere example with Developer Gadget App installed and code included in the form:

<form stylesheet="developer_gadgets:load.css" script="developer_gadgets:load.js">
  <label>Submit Button Testing</label>
  <fieldset submitButton="true">
    <input type="dropdown" token="tokPanel" searchWhenChanged="false">
      <label></label>
      <choice value="1">One</choice>
      <choice value="2">Two</choice>
      <default>1</default>
    </input>
    <input type="time" token="tokTime" searchWhenChanged="false">
      <label></label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <div>form.tokPanel- $form.tokPanel$</div>
        <div>form.tokTime- $form.tokTime.earliest$,$form.tokTime.latest$</div>
        <div>tokPanel- $tokPanel$</div>
        <div>tokTime- $tokTime.earliest$,$tokTime.latest$</div>
      </html>
    </panel>
  </row>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval tokenTimeEarliest=$tokTime.earliest|s$, tokenTimeLatest=$tokTime.latest|s$, tokPanel=$tokPanel|s$             
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

nick405060
Motivator

@niketnilay @snayak_splunk @rjthibod So how do you fix this behavior? How do you create an input where searchWhenChanged=false only updates a token upon button submission? Adding <change> does not fix the issue.

https://answers.splunk.com/answers/742451/searchwhenchangedfalse-not-honored-1.html

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!