Splunk 6 :: Form search query is running on form load ??

[rakesh_498115]

Hi All,

Not Sure why this has been running in Splunk 6 like this. I have a form with a timepicker and search button. As soon i open the form the search underlying it is being auto runned. tried setting the attribute autoRun="False" but that doesnt solve my purpose .

It works well in Splunk 5 versions but not on 6 . Is this expected behaviour ?? how can i handle this ?? i dnt want the form to auto load without an user intervention.

My Form Code ::

<form >
    <label>Sample form</label>
    <fieldset   autoRun="false" submitButton="true">    
        <input type="time">
            <default>Last 60 minutes</default>  
        </input>
    </fieldset>
    <row>
        <chart>
            <searchString >index=_internal |stats count by host</searchString>
            <title>Sample Test</title>
            <option name="charting.chart">pie</option>
            <option name="charting.chart.nullValueMode">gaps</option>
            <option name="charting.chart.stackMode">stacked</option>
            <option name="charting.drilldown">all</option>
            <option name="charting.layout.splitSeries">false</option>
            <option name="charting.legend.labelStyle.overflowMode">ellipsisNone</option>
            <option name="charting.legend.placement">right</option>
            <option name="height">200px</option>
            <option name="charting.data.count">0</option>
            <option name="charting.chart.sliceCollapsingThreshold">0</option>
            <option name="charting.chart.showPercent">true</option>
        </chart>
    </row>

</form>

Thanks

[martin_mueller]

You can force the search to rely on the form without changing the search results like this:

<form>
  <fieldset autoRun="false" submitButton="true">    
    <input type="time">
      <default>Last 60 minutes</default>  
    </input>
  </fieldset>
  <row>
    <table>
      <searchString >index=_internal | rename comment as "$earliest$" | stats count by host</searchString>
      <earliest>$earliest$</earliest>
      <latest>$latest$</latest>
    </table>
  </row>
</form>

The reference to a token in the rename causes the search to wait for the form to be submitted, while the rename itself does not affect search performance or search results.

[omorgan]

Worked for me. But why did I need this on a form that behaved just fine on splunk 5.0.4?

[rakesh_498115]

yes..i am not relying on any tokens ..but then i dont want the search to run on the form load.. i need the search to run only on user intervention.....how can i acheive this ??

[martin_mueller]

That may be related to your search not relying on any tokens from the form.