Splunk Search

How to refresh multiselect options with Javascript (re-execute the mutliselect search)

Afterimage
Engager

We have a custom dashboard in Splunk that has a few filters, one of which is a multiselect. This dashboard allows users to perform CRUD operations with POA&Ms. The multiselect in question lists all POA&M statuses that have been previously created, filtering the results displayed in the table.

Afterimage_0-1737057985877.png

The filter works fine for searching results for the table. The issue is that if someone creates a new POA&M with a status that hasn't been used yet, i.e. "Closed", the page must be refreshed for the multiselect to execute the search powering it and display "Closed" as an option. Is there a way to "refresh" the multiselect with Javascript after a new POA&M is created? The POA&M CRUD operations are performed with JS and Python btw. Here's the XML of the multiselect for reference:

Afterimage_1-1737058334128.png

 

Tags (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

If you have JS that is creating the new POA&M, then you could set a token in the JS that the multiselect search uses, When the token changes value, the multiselect search will re-run.

The MS would have something like

| inputlookup sp6_poams ``` $ms_trigger_token$ ```

i.e. it just needs to be in comments in the SPL and in your JS would do something like

    var defTokens = mvc.Components.get('default');
    var subTokens = mvc.Components.get('submitted');

    var value = defTokens.get('ms_trigger_token') + 1;
    defTokens.set('ms_trigger_token', value);
    subTokens.set('ms_trigger_token', value);

Untested, but it's easy enough to do directly in XML but with JS you just need to get and increment the current token value and set it back - not sure exactly which of the default and/or submitted token models needs updating, but doesn't hurt to do both.

View solution in original post

danspav
SplunkTrust
SplunkTrust

Hi @Afterimage,

There is an option to force the dropdown to re-run the search every X seconds.

Go into the Edit view and add this to the search:

<refresh>30</refresh>
<refreshType>delay</refreshType>

Like this:

danspav_1-1737081235749.png

That will make the lookup search re-run every 30 seconds, picking up any new values in the process.

 

-Spav

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you have JS that is creating the new POA&M, then you could set a token in the JS that the multiselect search uses, When the token changes value, the multiselect search will re-run.

The MS would have something like

| inputlookup sp6_poams ``` $ms_trigger_token$ ```

i.e. it just needs to be in comments in the SPL and in your JS would do something like

    var defTokens = mvc.Components.get('default');
    var subTokens = mvc.Components.get('submitted');

    var value = defTokens.get('ms_trigger_token') + 1;
    defTokens.set('ms_trigger_token', value);
    subTokens.set('ms_trigger_token', value);

Untested, but it's easy enough to do directly in XML but with JS you just need to get and increment the current token value and set it back - not sure exactly which of the default and/or submitted token models needs updating, but doesn't hurt to do both.

Afterimage
Engager

Thank you very much! You saved me a ton of time, I would never have thought to do it that way. This solution works great! 😀

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...