Splunk Search

Why Django drop-down selected value is not passed to the search?

kmattern
Builder

I'm trying to learn Django and created a simple app. All it is supposed to do is pass the selected drop-down value to a search, namely the name of a table. When the page loads the search kicks off right away and returns nothing but when a selection is made from the drop-down the search does not run and the token is not passed to the search. If I hard code the value, the results are displayed when the page loads. Here is the entirety of the code. Any help is appreciated.

{# Boilerplate for a Django Bindings template #}
{% extends "splunkdj:base_with_app_bar.html" %}

{% load splunkmvc %}

{% block title %}{{app_name}}User Status{% endblock title %}

{% block css %}
    <!-- Style sheets are loaded here -->
    <link rel="stylesheet" type="text/css" href="{{STATIC_URL}}{{app_name}}/custom.css" />
    <link rel="stylesheet" type="text/css" href="{{STATIC_URL}}splunkjs/css/dashboard.css" />
    <style>
        /* Define any page styles here*/
    </style>
{% endblock css %}

{% block content %}
<div class="dashboard-body container-fluid main-section-body" data-role="main">

    <div class="dashboard-header clearfix">
        <h2>User Stats</h2>
        <p class="description">A Django based status dashboard</p>
    </div>

    <!-- Row One Select data type dropdown-->
    <div class="dashboard-row dashboard-row1">
        <div class="dashboard-cell" style="width: 100%;">
            <div class="dashboard-panel clearfix">
                <div class="dashboard-element">
                    <div class="panel-head">
                        <h3>Select Type:</h3>
                    </div>
                    <div class="panel-body">
                        {% dropdown id="drop_SelectedTable" value="$SelectedTable$"|token_safe showClearButton=false %}
                    </div>
                </div>
            </div>
        </div>
   </div>

     <!-- Row Two  -->
    <div class="dashboard-row dashboard-row2">
        <div class="dashboard-cell" style="width: 100%;">
            <div class="dashboard-panel clearfix">                
                <div class="panel-element-row">
                    <div class="dashboard-element table" style="width: 100%">
                        <div class="panel-head">
                            <h3>Search results</h3>
                        </div>
                        <div class="panel-body">
                            {% table id="table_searchresults" managerid="UserStatus" %}
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>

</div>
{% endblock content%}

{% block managers %}
    {% searchmanager 
        id="UserStatus" 
        search="|inputlookup $SelectedTable$.csv" 
        cache=True
    %}
{% endblock managers %}

{% block js %}
<script>
    var deps = [
        "splunkjs/ready!",
        "splunkjs/mvc/radiogroupview"
    ];
    require(deps, function(mvc) {
        // Define choices for the dropdown list
        var choices_SelectedTable = [
            {label:"Users", value: "Users"},
            {label:"Master", value: "Master"},
            {label:"Clients", value: "Clients"}
        ];

        // Get the dropdown list and set the choices
        splunkjs.mvc.Components.getInstance("drop_SelectedTable").settings.set("choices", choices_SelectedTable); 
        });
</script>
{% endblock js %}
0 Karma
1 Solution

kmattern
Builder

My search was much more complex than shown above. But the solution was very simple. The search read:

search="|inputlookup $SelectedTable$.csv"

Where it should have read:

search="|inputlookup $SelectedTable$.csv"|token_safe

It made all the difference in the world.

View solution in original post

0 Karma

kmattern
Builder

My search was much more complex than shown above. But the solution was very simple. The search read:

search="|inputlookup $SelectedTable$.csv"

Where it should have read:

search="|inputlookup $SelectedTable$.csv"|token_safe

It made all the difference in the world.

0 Karma

masonmorales
Influencer

This might be a shot in the dark, but what happens if you do an eval statement before your inputlookup?

i.e. search="eval MyTable=$SelectedTable$+".csv" |inputlookup MyTable"

0 Karma

kmattern
Builder

That didn't work, the parameter was still not passed to the search.

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...