Splunk Search

Search is executed after changing dropdown value but token is not in search

haph
Path Finder

Hi guys,

I have a dashboard where a user inputs data using dropdowns and text inputs. 

If he inputs all data and click on submit a hidden search (row) is executed which populates a lookup with values of the tokens of the input fields. The next row displays a table with the lookup content.

Additional to that there is a row with one dropdown to select a tool from a production machine. If this dropdown is used, a search is started which searches after produced pieces of this tool since the last entry of that tool in lookup above. If he clicks on the single value displayed from the search, the piece count is pasted into the matching field of the main inputs above.  This helps the user to get all data for the input into the lookup.

Now the problem is, that dropdown for the tool selection has searchWhenChanged=true so the search for the piece count can start. But sometimes (not every time I think) it also starts the hidden search from above and sends data to the lookup although the submit button wasn't clicked. This results in unwanted data.

What I tried is to unset all input tokens after the hidden search is done. This prevents it from sending data to the lookup without clicking submit because there are missing tokens for that search. But it deletes the input too just when selecting a tool. 

 

In short: Is there a way to specify which search is executed by changing a input field / token and not just all searches?

Thanks!

 

Here is the SimpleXML:

 

 

<form hideFilters="true" theme="dark">
  <label>Edelhoff Werkzeug Wartungsboard</label>
  <init>
    <eval token="default_von">strftime(now(),"%d.%m.%Y")</eval>
    <eval token="default_bis">strftime(now(),"%d.%m.%Y")</eval>
    <set token="tok_trigger"></set>
    <set token="tok_trigger_date_update"></set>
  </init>
  <fieldset submitButton="true">
    <input type="dropdown" token="tok_WN" searchWhenChanged="false">
      <label>Auswahl Werkzeug</label>
      <fieldForLabel>Werkzeugname</fieldForLabel>
      <fieldForValue>Werkzeugnummer</fieldForValue>
      <search>
        <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu
| dedup Werkzeugnummer
| fields Werkzeugnummer
| sort Werkzeugnummer
| lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeugnummer OUTPUTNEW Werkzeugname
| table Werkzeugnummer Werkzeugname</query>
        <earliest>0</earliest>
        <latest></latest>
      </search>
    </input>
    <input type="dropdown" token="tok_grund" searchWhenChanged="false">
      <label>Ausfallgrund</label>
      <choice value="Gratbildung">Gratbildung</choice>
      <choice value="Massabweichung">Maßabweichung</choice>
      <choice value="sichtbarerSchaden">sichtbarer Schaden</choice>
      <choice value="Elektrik">Elektrik</choice>
      <choice value="Hydraulik">Hydraulik</choice>
      <choice value="StempelGebrochen">Stempel gebrochen</choice>
    </input>
    <input type="dropdown" token="tok_massnahme" searchWhenChanged="false">
      <label>Instandsetzungsmaßnahme</label>
      <choice value="Nachschleifen">Nachschleifen</choice>
      <choice value="Stempel-/Matrizenwechsel">Stempel- /Matrizenwechsel</choice>
      <choice value="Federn">Federn</choice>
      <choice value="Führungen">Führungen</choice>
    </input>
    <input type="text" token="tok_end_rep" searchWhenChanged="false">
      <label>gewartet zurück</label>
      <initialValue>$default_bis$</initialValue>
      <default>$default_bis$</default>
    </input>
    <input type="text" token="tok_stueckzahl" searchWhenChanged="false">
      <label>Stückzahl</label>
      <default>-</default>
      <initialValue>-</initialValue>
    </input>
    <input type="text" token="tok_details" searchWhenChanged="false">
      <label>Bemerkungen</label>
      <default>-</default>
      <initialValue>-</initialValue>
    </input>
  </fieldset>
  <row depends="$never_show_this_row$">
    <panel>
      <table>
        <search>
          <done>
            <unset token="form.tok_WN"></unset>
            <unset token="form.tok_grund"></unset>
            <unset token="form.tok_massnahme"></unset>
            <unset token="form.tok_end_rep"></unset>
            <unset token="form.tok_stueckzahl"></unset>
            <unset token="form.tok_details"></unset>
            <eval token="default_von">strftime(now(),"%d.%m.%Y")</eval>
            <eval token="default_bis">strftime(now(),"%d.%m.%Y")</eval>
            <eval token="form.default_von">strftime(now(),"%d.%m.%Y")</eval>
            <eval token="form.default_bis">strftime(now(),"%d.%m.%Y")</eval>
          </done>
          <query>| makeresults 
| eval Werkzeug="$tok_WN$" 
| eval Wartungsgrund="$tok_grund$" 
| eval Wartungsmaßnahme="$tok_massnahme$" 
| eval rep_back="$tok_end_rep$" 
| eval Stueckzahl="$tok_stueckzahl$" 
| eval Bemerkungen="$tok_details$"
| fields Auftrag Werkzeug Wartungsgrund Wartungsmaßnahme "zum WZB" rep_back Stueckzahl Bemerkungen 
| fields - _time 
| outputlookup append=t W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
    <panel>
      <table>
        <search>
          <done>
            <set token="tok_rep">$result.rep_back$</set>
          </done>
          <query>| inputlookup W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv
| eval _time=strptime(rep_back,"%d.%m.%Y")
| stats latest(rep_back) as timestamp by Maschine 
| eval header=rep_back 
| transpose 100 header_field=header 
| where Werkzeug=="$tok_WN$"</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="count">5</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Wartungshistorie</title>
      <table>
        <search>
          <done>
            <eval token="tok_trigger_date_update">now()</eval>
          </done>
          <query>| inputlookup append=t W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv
| lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeug OUTPUTNEW Werkzeugname

| eval _time=strptime(rep_back,"%d.%m.%Y") 
| rename rep_back as "repariert zurück"
| sort - _time 
| fillnull value="-"
| fields - _time

| table "repariert zurück" Werkzeugname Werkzeug Wartungsgrund Wartungsmaßnahme Stueckzahl Bemerkungen
| rename Werkzeug as Speicherplatznummer</query>
          <earliest>0</earliest>
          <latest></latest>
          <sampleRatio>1</sampleRatio>
          <refresh>15s</refresh>
          <refreshType>delay</refreshType>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
        <drilldown>
          <set token="tok_WN">$row.Speicherplatznummer$</set>
          <set token="tok_WN2">$row.Speicherplatznummer$</set>
          <set token="form.tok_WN">$row.Speicherplatznummer$</set>
          <set token="form.tok_WN2">$row.Speicherplatznummer$</set>
        </drilldown>
      </table>
    </panel>
  </row>
  <row>
    <panel>
      <title>Werkzeug Stückzahlen nach der letzten Wartung</title>
      <input type="dropdown" token="tok_WN2" searchWhenChanged="true">
        <label>Auswahl Werkzeug</label>
        <fieldForLabel>Werkzeugname</fieldForLabel>
        <fieldForValue>Werkzeugnummer</fieldForValue>
        <search>
          <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu
| dedup Werkzeugnummer
| fields Werkzeugnummer
| sort Werkzeugnummer
| lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeugnummer OUTPUTNEW Werkzeugname
| table Werkzeugnummer Werkzeugname</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </input>
      <single>
        <title>seit $tok_end_rep2$</title>
        <search>
          <done>
            <set token="tok_end_rep2">$result.back$</set>
          </done>
          <query>index=machinedata_w05 source=W05FBEdelhoffIV7460 Werkzeugnummer_1min OR name=Werkzeugnummer_10min OR name=NSW_Stempel_Winkel_Aktuell10ms earliest=@d latest=now
    | eval Nummer=case(name=="Werkzeugnummer_10min", value, Werkzeugnummer_1min!="", Werkzeugnummer_1min)

    | eval {name}=value

    | rename NSW_Stempel_Winkel_Aktuell10ms as Winkel 

    | reverse
    | filldown Nummer
    | reverse
    | filldown Winkel
    | where Nummer=$tok_WN2$

    | eval pressing = if((Winkel&gt;130 AND Winkel&lt;150), 1, 0)
    | fields pressing _time Kraft1 Nummer Hauptantrieb_Strom Hauptantrieb_Temperatur Hauptantrieb_Drehmoment Hubhoehe
    | filldown
    | autoregress pressing
    | eval pressingAction = if(pressing==1 AND pressing_p1==0, 2, 0)

    | reverse
    | stats c(eval(pressingAction==2)) as Stueckzahl
    
| eval Stueckzahl = Stueckzahl + 
    [ 
    | search index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu Werkzeugnummer=$tok_WN2$ [
                                            | inputlookup W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv where Werkzeug=$tok_WN2$
                                             
                                            | fields rep_back 
                                            | eval rep_back=strptime(rep_back,"%d.%m.%Y") 
                                            | sort - rep_back 
                                            | head 1 
                                            | eval result="earliest=\"".rep_back."\"" 
                                            | return $result
                                            ] latest=now
| stats c as Stueckzahl
    | return $Stueckzahl
    ]
| appendcols
    [
    | inputlookup W05_PS_Edelhoff_Werkzeug_Wartung_TEST.csv where Werkzeug=$tok_WN2$
                                             
                                            | fields rep_back 
                                            | eval rep_back=strptime(rep_back,"%d.%m.%Y") 
                                            | sort - rep_back 
                                            | head 1 
                                            | eval result=strftime(rep_back, "%d.%m.%y") 
                                            | return $result
                                            ]
| rename search as back</query>
          <earliest>1566774000</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">all</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
        <drilldown>
          <set token="form.tok_stueckzahl">$click.value$</set>
          <set token="tok_stueckzahl">$click.value$</set>
        </drilldown>
      </single>
    </panel>
  </row>
  <row>
    <panel>
      <title>Werkzeug Gesamtstückzahl</title>
      <input type="dropdown" token="tok_WN2" searchWhenChanged="false">
        <label>Auswahl Werkzeug</label>
        <fieldForLabel>Werkzeugname</fieldForLabel>
        <fieldForValue>Werkzeugnummer</fieldForValue>
        <search>
          <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu
| dedup Werkzeugnummer
| fields Werkzeugnummer
| sort Werkzeugnummer
| lookup Edelhoff_Werkzeugliste_TEST.csv Speichernummer as Werkzeugnummer OUTPUTNEW Werkzeugname
| table Werkzeugnummer Werkzeugname</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
      </input>
      <single>
        <search>
          <query>index=machinedata_w05_sum app=Presskraft_pro_Werkzeug_neu Werkzeugnummer=$tok_WN2$ 
| stats c as Stueckzahl
| eval Stueckzahl = Stueckzahl + 
    [ 
    | search index=machinedata_w05 source=W05FBEdelhoffIV7460 Werkzeugnummer_1min OR name=Werkzeugnummer_10min OR name=NSW_Stempel_Winkel_Aktuell10ms earliest=@d latest=now
    | eval Nummer=case(name=="Werkzeugnummer_10min", value, Werkzeugnummer_1min!="", Werkzeugnummer_1min)

    | eval {name}=value

    | rename NSW_Stempel_Winkel_Aktuell10ms as Winkel 

    | reverse
    | filldown Nummer
    | reverse
    | filldown Winkel
    | where Nummer=$tok_WN2$

    | eval pressing = if((Winkel&gt;130 AND Winkel&lt;150), 1, 0)
    | fields pressing _time Kraft1 Nummer Hauptantrieb_Strom Hauptantrieb_Temperatur Hauptantrieb_Drehmoment Hubhoehe
    | filldown
    | autoregress pressing
    | eval pressingAction = if(pressing==1 AND pressing_p1==0, 2, 0)

    | reverse
    | stats c(eval(pressingAction==2)) as counter
    | return $counter
    ]</query>
          <earliest>1566774000</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="colorBy">value</option>
        <option name="colorMode">none</option>
        <option name="drilldown">none</option>
        <option name="numberPrecision">0</option>
        <option name="rangeColors">["0x53a051", "0x0877a6", "0xf8be34", "0xf1813f", "0xdc4e41"]</option>
        <option name="rangeValues">[0,30,70,100]</option>
        <option name="refresh.display">progressbar</option>
        <option name="showSparkline">1</option>
        <option name="showTrendIndicator">1</option>
        <option name="trellis.enabled">0</option>
        <option name="trellis.scales.shared">1</option>
        <option name="trellis.size">medium</option>
        <option name="trendColorInterpretation">standard</option>
        <option name="trendDisplayMode">absolute</option>
        <option name="unitPosition">after</option>
        <option name="useColors">0</option>
        <option name="useThousandSeparators">1</option>
      </single>
    </panel>
  </row>
</form>

 

 

 

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...