submit button not passing tokens

[newbie2tech]

Hi All

I am running into some strange behavior(atleast for me) with dashboard submit button

Dashboard has
time picker
1 textbox input [which takes comma separated order numbers]
Submit button

My usecase is to allow the Support teams look up customer details using order numbers[they can enter any number of orders 1 or 10 or 100 or 1000 all , seperated], output gives customer name,custmer email,order number.

When i choose the time , key in say 2 order numbers and hit submit button ...my panel searches are not triggered as the tokens are not passed on to panels(i am displaying tokens in panel titles), however when i click the cross max on the text box to remove the value and click anywhere on dashboard[i am not clicking submit button] the tokens are being passed and the panels work. In short submit button does not seem to work.

Any idea why this behavior is happening and how it can be corrected.

Example:

Input=ord123,ord234,ord345
search becomes -->index=xyz ord123 OR ord234 OR ord345| table orderid,cust_firstname,cust_lastname,cust_email
Label -->Customer Details---ord123 OR ord234 OR ord345

<form>
  <label> Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="Orderid_token" searchWhenChanged="false">
      <label>Enter OrderNumber</label>
      <change>
        <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
      </change>
    </input>
  </fieldset> 
  <row>
    <panel>
      <title>Customer Details---$Orderid_frmt_token$</title>
      <table>
        <search>
          <query>index=xyz  $Orderid_frmt_token$| table orderid,cust_firstname,cust_lastname,cust_email </query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    </row>
</form>

[woodcock · Accepted solution]

OK, let's just bypass the <eval> thing altogether and replace with a subsearch. This seems to work just fine:

<form>
  <label>Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="Orderid_token" searchWhenChanged="false">
      <label>Enter OrderNumber</label>
      <!--change>
        <condition value="">
          <unset token="Orderid_frmt_token"></unset>
        </condition>
        <condition value="*">
          <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
        </condition>
      </change-->
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Customer Details---$Orderid_token$</title>
      <table>
        <search>
          <query>index=_* [| makeresults | eval search=replace("$Orderid_token$",","," OR ") | fields - _time] | stats count BY host source sourcetype index</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

[newbie2tech]

Thanks woodcock...this worked like a charm. Wanted to ask will it have any limitations in terms of how many values it can take[like 10000 only?].

[woodcock]

It looks to me that using <eval> like this with the submit button is TOTALLY borked and a support case should be opened. I am sure that your code should be more like this (which causes your incorrectly-working clear-field case to be correctly-nonworking), but it does not really fix much:

  <change>
    <condition value="">
      <unset token="Orderid_frmt_token"></unset>
    </condition>
    <condition value="*">
      <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
    </condition>
  </change>

[nick405060]

So your workaround (your answer) worked for his use case but doesn't for mine. I need to do something like the above. Any ideas?

https://answers.splunk.com/answers/742451/searchwhenchangedfalse-not-honored-1.html

[niketn]

Since you are setting the token on change event of the Text box you should turn on searchWhenChanged="true" for the same.

<input type="text" token="Orderid_token" searchWhenChanged="true">
  <label>Enter OrderNumber</label>
  <change>
    <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
  </change>
</input>

[newbie2tech]

thanks niketnilay... for the first option which you suggested i had tried those combinations before posting the question it did not work and as woodcock mentioned Submit button would have no meaning.
2nd suggestion does not work for me as i have 4 panels i cannot input them in each panel.thank you for chiming in.

Thanks rjthibod for the information.

[woodcock]

This totally defeats the purpose of the submit button.

[rjthibod]

Just as an FYI, the change handler set, unset, and eval statements always alter the submitted token value, regardless of the searchWhenChanged setting. This holds for all input types regardless of the submit button being present or not. This side effect has been the bane of my dashboards in many cases.

[niketn]

Yes I know but my point was that if change event handler has to be coded then searchWhenChanged should be turned on as well. Following is a way Text box can be grouped in the panel with Search so that Submit button applies for Time and Text box remain independent of Submit button.

<form>
  <label>Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Customer Details---$Orderid_frmt_token$</title>
      <input type="text" token="Orderid_token" searchWhenChanged="true">
        <label>Enter OrderNumber</label>
        <change>
          <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
        </change>
      </input>
       <table>
         <search>
           <query>index=xyz  $Orderid_frmt_token$| table orderid,cust_firstname,cust_lastname,cust_email </query>
           <earliest>$time_token.earliest$</earliest>
           <latest>$time_token.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
     </panel>
     </row>
</form>