Splunk Enterprise

submit button not passing tokens

newbie2tech
Communicator

Hi All

I am running into some strange behavior(atleast for me) with dashboard submit button

Dashboard has
time picker
1 textbox input [which takes comma separated order numbers]
Submit button

My usecase is to allow the Support teams look up customer details using order numbers[they can enter any number of orders 1 or 10 or 100 or 1000 all , seperated], output gives customer name,custmer email,order number.

When i choose the time , key in say 2 order numbers and hit submit button ...my panel searches are not triggered as the tokens are not passed on to panels(i am displaying tokens in panel titles), however when i click the cross max on the text box to remove the value and click anywhere on dashboard[i am not clicking submit button] the tokens are being passed and the panels work. In short submit button does not seem to work.

Any idea why this behavior is happening and how it can be corrected.

Example:

Input=ord123,ord234,ord345
search becomes -->index=xyz ord123 OR ord234 OR ord345| table orderid,cust_firstname,cust_lastname,cust_email
Label -->Customer Details---ord123 OR ord234 OR ord345

<form>
  <label> Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="Orderid_token" searchWhenChanged="false">
      <label>Enter OrderNumber</label>
      <change>
        <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
      </change>
    </input>
  </fieldset> 
  <row>
    <panel>
      <title>Customer Details---$Orderid_frmt_token$</title>
      <table>
        <search>
          <query>index=xyz  $Orderid_frmt_token$| table orderid,cust_firstname,cust_lastname,cust_email </query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    </row>
</form>
0 Karma
1 Solution

woodcock
Esteemed Legend

OK, let's just bypass the <eval> thing altogether and replace with a subsearch. This seems to work just fine:

<form>
  <label>Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="Orderid_token" searchWhenChanged="false">
      <label>Enter OrderNumber</label>
      <!--change>
        <condition value="">
          <unset token="Orderid_frmt_token"></unset>
        </condition>
        <condition value="*">
          <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
        </condition>
      </change-->
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Customer Details---$Orderid_token$</title>
      <table>
        <search>
          <query>index=_* [| makeresults | eval search=replace("$Orderid_token$",","," OR ") | fields - _time] | stats count BY host source sourcetype index</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

woodcock
Esteemed Legend

OK, let's just bypass the <eval> thing altogether and replace with a subsearch. This seems to work just fine:

<form>
  <label>Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="text" token="Orderid_token" searchWhenChanged="false">
      <label>Enter OrderNumber</label>
      <!--change>
        <condition value="">
          <unset token="Orderid_frmt_token"></unset>
        </condition>
        <condition value="*">
          <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
        </condition>
      </change-->
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Customer Details---$Orderid_token$</title>
      <table>
        <search>
          <query>index=_* [| makeresults | eval search=replace("$Orderid_token$",","," OR ") | fields - _time] | stats count BY host source sourcetype index</query>
          <earliest>$time_token.earliest$</earliest>
          <latest>$time_token.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

newbie2tech
Communicator

Thanks woodcock...this worked like a charm. Wanted to ask will it have any limitations in terms of how many values it can take[like 10000 only?].

0 Karma

woodcock
Esteemed Legend

It looks to me that using <eval> like this with the submit button is TOTALLY borked and a support case should be opened. I am sure that your code should be more like this (which causes your incorrectly-working clear-field case to be correctly-nonworking), but it does not really fix much:

  <change>
    <condition value="">
      <unset token="Orderid_frmt_token"></unset>
    </condition>
    <condition value="*">
      <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
    </condition>
  </change>
0 Karma

nick405060
Motivator

So your workaround (your answer) worked for his use case but doesn't for mine. I need to do something like the above. Any ideas?

https://answers.splunk.com/answers/742451/searchwhenchangedfalse-not-honored-1.html

0 Karma

niketnilay
Legend

Since you are setting the token on change event of the Text box you should turn on searchWhenChanged="true" for the same.

<input type="text" token="Orderid_token" searchWhenChanged="true">
  <label>Enter OrderNumber</label>
  <change>
    <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
  </change>
</input>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

newbie2tech
Communicator

thanks niketnilay... for the first option which you suggested i had tried those combinations before posting the question it did not work and as woodcock mentioned Submit button would have no meaning.
2nd suggestion does not work for me as i have 4 panels i cannot input them in each panel.thank you for chiming in.

Thanks rjthibod for the information.

0 Karma

woodcock
Esteemed Legend

This totally defeats the purpose of the submit button.

0 Karma

rjthibod
Champion

Just as an FYI, the change handler set, unset, and eval statements always alter the submitted token value, regardless of the searchWhenChanged setting. This holds for all input types regardless of the submit button being present or not. This side effect has been the bane of my dashboards in many cases.

0 Karma

niketnilay
Legend

Yes I know but my point was that if change event handler has to be coded then searchWhenChanged should be turned on as well. Following is a way Text box can be grouped in the panel with Search so that Submit button applies for Time and Text box remain independent of Submit button.

<form>
  <label>Customer Details using Order Number</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="time_token" searchWhenChanged="false">
      <label>Select Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Customer Details---$Orderid_frmt_token$</title>
      <input type="text" token="Orderid_token" searchWhenChanged="true">
        <label>Enter OrderNumber</label>
        <change>
          <eval token="Orderid_frmt_token">replace($Orderid_token$,","," OR ")</eval>
        </change>
      </input>
       <table>
         <search>
           <query>index=xyz  $Orderid_frmt_token$| table orderid,cust_firstname,cust_lastname,cust_email </query>
           <earliest>$time_token.earliest$</earliest>
           <latest>$time_token.latest$</latest>
           <sampleRatio>1</sampleRatio>
         </search>
         <option name="count">100</option>
         <option name="dataOverlayMode">none</option>
         <option name="drilldown">cell</option>
         <option name="percentagesRow">false</option>
         <option name="rowNumbers">false</option>
         <option name="totalsRow">false</option>
         <option name="wrap">true</option>
       </table>
     </panel>
     </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!