Splunk Search

Why does search is not running again until the time is not changed?

mr_brightside
Explorer

Hi all,

I would like to know why the search cannot be re-run until i change the time interval for it?

I have my dashboards running on Splunk 6.03. The dashboards were written in Simple XML.

If i open some dashboard, select for example "last 15 minutes" and press "Search", then i'll receive results for that period of time.

Now if i wait for a minute (or for a day) and run the same search on the same dashboard (that was not reloaded) by pressing the "Search" button again nothing will happen.

But, for this situation last 15 minutes will contain another results.

I'm asking about this behaviour because in Advanced XML i was able to click "Search" for some timeinterval to receive data, then i was able to click "Search" again and again without changing the timeinterval, without refreshing the page and the results were displayed.

I haven't found any description in the documentation...

0 Karma

mr_brightside
Explorer

I've returned to this problem.

I've installed 6.1.1. In that version we have FormUtils module:

share/splunk/search_mrsparkle/exposed/js/splunkjs/mvc/simpleform/formutils.js

Here we have method submitForm, that could be extended by our own script:

require([
    'underscore',
    'jquery',
    'splunkjs/mvc',
    'splunkjs/mvc/simpleform/formutils',
    'splunkjs/mvc/simplexml/ready!',
    'splunkjs/ready!'
], function(_, $, mvc, FormUtils) {

    _.extend(FormUtils, {
        submitForm: _.debounce(function(options) {...}
    }
}

This could be good start point to search the final solution.

But, this is only for 6.1.1. If you install 6.0.x you will never find that formutils.js file. In this case i think that there is no common solution for this.

Another suggestion, which is simpler, is just to take saved url (after pressing the submit button, our filters are saved in the url) and to reload the page with it.

I would like to know, that solution is the best. Has anybody solved that in another way?

0 Karma

mr_brightside
Explorer

Working on another issue i've found some examples on how to work with the search manager and with timeline/timerange. The information is present in DEV portal of splunk.

Here are some useful links:

http://dev.splunk.com/view/SP-CAAAEW4
http://dev.splunk.com/view/SP-CAAAET9

I'm sure, that i can change the default behaviour of the Search button with that.

0 Karma

cbehm
Explorer

I just installed 6.1.1 and as far as I can tell it's still broken.

0 Karma

mr_brightside
Explorer

Seems like it's really a splunk bug:

http://docs.splunk.com/Documentation/Splunk/6.0.3/ReleaseNotes/Knownissues#REST.2C_Simple_XML.2C_and...

Submit button in Simple xml will not
re-run search without change to
time-picker. (SPL-77989)

There is no such info in issues for 6.1.0, - apparently they've fixed that. While i've not tested 6.1.x yet i don't think that creating any workaround is necessary here.

0 Karma

cbehm
Explorer

I've been searching for a reason and a fix/work-around as well. Personally I classify it as a bug - there's an enabled UI element (the search button) that actually doesn't work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...