Splunk Search

How to disable a search for a dashboard panel?

Path Finder

I have a dashboard (really a form) with few panels each doing a search and export and several input fields each (all set to some default so they are not always change and are ready for a search even if the user is not changing any of them). All items have searchonchange set to false so the user makes all the input before pushing submit. My goal is to enable the user to skip a few of the searches. I could hide each panel with checkbox at the top and use "depends" in the panel, but that only hides the panel. The search still runs when I click the submit. How can I disable the search itself?

Tags (3)

Path Finder

Hi Avilandau,

Did you get the solution? I am having similar issue. Panel is getting hide but that query of hidden panel always run in background. I want to avoid that.

0 Karma

Path Finder

I have the same problem... In my case I am trying to have both a "dry run" and "update" option to the search.
1) I tried disabling / enabling the panel "view" but that did not work. https://answers.splunk.com/answers/639048/how-to-make-panel-depend-on-token-value.html
2) I also tried changing the function of my "final Search" (last line in my search query) to a "dry run: dummy search string" and the "update: append to lookuptable". It seems that since this changes the "search query itself" -- the panel search query gets rerun -- even though the "Submit" button has not been selected. All other form input fields (note: 'search on change' is disabled for all) simply change variables rather than search queries themselves though.

On my dropdown input, it seems explicitly stating searchWhenChanged="false" does help.

<fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="input-dryrunORupdate" searchWhenChanged="false" >
      <label>DryRun or Update</label>
      <choice value="DryRun">DryRun</choice>
      <choice value="Update">Update</choice>
      <change>
        <condition value="DryRun">
          <set token="tokFinalSearch">eval x=y | fields - x</set>
        </condition>
        <condition value="Update">
          <set token="tokFinalSearch">outputlookup append=true access-events.csv</set>
        </condition>
      </change>
      <default>DryRun</default>
      <initialValue>DryRun</initialValue>
    </input>
  <!-- ... more inputs ... -->
</fieldset>

The last line of my panel search query is:

| $tokFinalSearch$
0 Karma

Legend

@anantdeshpande, One workaround would be if your input tokens are input1, input2, input3 etc. would be to include the same in your search (possibly after the final transforming to display your results)

| eval dummyField=$input1$.$input2$.$input3$
| fields - dummyField
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

Hi,
I tried using dummy token from drop down value itself . As I am using * as default value in all filter criteria.
This dummy token will get value as * and search will run. Also I am using change condition flag to show/hide panel. So problem is still there that whenever token is getting set from drop down, all queries will run with default values.

0 Karma

Hi avilandau, Let propose an other approach to you: Building a form with a dropdown that content all your searches So the user can choose the one he want to run .
to do that:
1- you use savedsearches at the place of each panel query.

2- you populate the dropdown with the names of your savedsearches(using choice tag)

3-In the searchString tag you put |savedsearch $token_of_the_dropdown$ ..............

4- doing so only one query will be run at a time.

5- NOTE:if you want to run more than one query or have more than one pane, you can simply put input dropdown in each panels.

0 Karma

Motivator

Hi avilandau
It is better for you to delete this panel in your dashboard search code instead of search the way to disable the panel.

0 Karma

Path Finder

I guess you didn't get my point. I want to have a checkbox on the screen that control when to disable it and when to have it (i.e. I don't need to get rid of it I just need to have it dynamic per user decision).

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!