I have a dashboard (really a form) with few panels each doing a search and export and several input fields each (all set to some default so they are not always change and are ready for a search even if the user is not changing any of them). All items have searchonchange set to false so the user makes all the input before pushing submit. My goal is to enable the user to skip a few of the searches. I could hide each panel with checkbox at the top and use "depends" in the panel, but that only hides the panel. The search still runs when I click the submit. How can I disable the search itself?
I have the same problem... In my case I am trying to have both a "dry run" and "update" option to the search.
1) I tried disabling / enabling the panel "view" but that did not work. https://answers.splunk.com/answers/639048/how-to-make-panel-depend-on-token-value.html
2) I also tried changing the function of my "final Search" (last line in my search query) to a "dry run: dummy search string" and the "update: append to lookuptable". It seems that since this changes the "search query itself" -- the panel search query gets rerun -- even though the "Submit" button has not been selected. All other form input fields (note: 'search on change' is disabled for all) simply change variables rather than search queries themselves though.
On my dropdown input, it seems explicitly stating searchWhenChanged="false" does help.
<fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="input-dryrunORupdate" searchWhenChanged="false" > <label>DryRun or Update</label> <choice value="DryRun">DryRun</choice> <choice value="Update">Update</choice> <change> <condition value="DryRun"> <set token="tokFinalSearch">eval x=y | fields - x</set> </condition> <condition value="Update"> <set token="tokFinalSearch">outputlookup append=true access-events.csv</set> </condition> </change> <default>DryRun</default> <initialValue>DryRun</initialValue> </input> <!-- ... more inputs ... --> </fieldset>
The last line of my panel search query is:
@anantdeshpande, One workaround would be if your input tokens are
input1, input2, input3 etc. would be to include the same in your search (possibly after the final transforming to display your results)
| eval dummyField=$input1$.$input2$.$input3$ | fields - dummyField
I tried using dummy token from drop down value itself . As I am using * as default value in all filter criteria.
This dummy token will get value as * and search will run. Also I am using change condition flag to show/hide panel. So problem is still there that whenever token is getting set from drop down, all queries will run with default values.
Hi avilandau, Let propose an other approach to you: Building a form with a dropdown that content all your searches So the user can choose the one he want to run .
to do that:
1- you use savedsearches at the place of each panel query.
2- you populate the dropdown with the names of your savedsearches(using choice tag)
3-In the searchString tag you put |savedsearch $token_of_the_dropdown$ ..............
4- doing so only one query will be run at a time.
5- NOTE:if you want to run more than one query or have more than one pane, you can simply put input dropdown in each panels.
I guess you didn't get my point. I want to have a checkbox on the screen that control when to disable it and when to have it (i.e. I don't need to get rid of it I just need to have it dynamic per user decision).