Splunk Search

How to get a search to only run on-click of a Submit button, not when users change selected drop-down values in an HTML dashboard?

theoborrero
Explorer

What is the correct Splunk name for the Magnifying Glass "Submit Button Icon" connected to the search bar, in Splunk?
How do we restrict results to show only when submit button is "clicked" in the SearchbarView, and not automatically update search as users change/update drop-down menus in our application?
We have created this dashboard in Splunk 6.2.6 with HTML.
Currently we can control our search from firing off , until we change the timerange value in SearchbarView.
So ideally, we should be able to use the exact same code below for the submit button on click, but that has not work so far.

alt text

What is the value or name of the magnifying icon button, and why the heck would it not work when we click it , if everything works correctly when we click anynew time range input from the All time button? Ideally we should be able to change the "mysearchbar.timerange.on " to mysearchbar.( <--- Name of whatever the magnifyingclass button name is called in splunk ).on and it should work the same

      mysearchbar.timerange.on("change", function() {
             sampleSearchManager.startSearch();
             sampleSearchManager1.startSearch();
             sampleSearchManager.settings.set(mysearchbar.timerange.val());
             sampleSearchManager1.settings.set(mysearchbar.timerange.val());
         }); 
0 Karma

sundareshr
Legend

You have a searchbar.on("change" ...) event that calls the startsearch() on your search managers. Change from searchbar.on("change",... to SubmitButton.on("click"... event. See if that helps.

0 Karma

kevshah
Explorer

For this code below, submit button works, but it updates results every time you change anything in searchbar (even query or timerange value).

  mysearchbar.on("change", function() {
            sampleSearchManager.startSearch();
            sampleSearchManager1.startSearch();
            emlNoise.startSearch();
            emlDashboard.startSearch();

            sampleSearchManager.settings.set(mysearchbar.timerange.val());
            sampleSearchManager1.settings.set(mysearchbar.timerange.val());
            emlNoise.settings.set(mysearchbar.timerange.val());
            emlDashboard.settings.set(mysearchbar.timerange.val());
        });

This how searchmanager looks like. Adding SubmitButton="true" still doesn't give results.

   var sampleSearchManager = new SearchManager({
            "id": "sampleSearchManager",
            "status_buckets": 300,
            "latest_time": "$latest$",
            "search":  "",
            "earliest_time": "0",
            "cancelOnUnload": true,
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            "autostart": false,
            "submitButton": true,
            "preview": true,
            "runWhenTimeIsUndefined": false
        }, {tokens: true, tokenNamespace: "submitted"});
0 Karma

Richfez
SplunkTrust
SplunkTrust

Or, "Edit Panels", edit each of the inputs involved and clear the "Search on Change" checkbox?

0 Karma

woodcock
Esteemed Legend

Switch to simpleXML and then use this:

<fieldset autoRun="false" submitButton="true">
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...