Splunk Search

<change> event firing before the user ever makes a change to the form input?

tonymaibox
New Member

Hi all, hope all is well!

I'm unsetting a token in the <change> block of a <query>. However, I'm finding that the <unset> event in the <change> block gets fired on initial load before the user ever makes a change to the input. Is this a bug?

Sample code:

<input>
  <search>
    <query>
    </query>
    <change>
      <condition>
        <unset token="some_token"></unset>
      </condition>
    </change>
  </search>
</input>

Labels (1)
0 Karma

tscroggins
Influencer

@tonymaibox 

Your condition has no match attribute, so it will match all events, including form initialization.

For example, foo_tok is cleared on init in this Simple XML:

<form>
  <init>
    <set token="foo_tok">initialized</set>
  </init>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <label>Sample Input</label>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <search>
        <query>| stats count</query>
      </search>
      <change>
        <condition>
          <unset token="foo_tok"></unset>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$foo_tok$</title>
    </panel>
  </row>
</form>

 You can control when unset is invoked by adding constraints to the condition element:

 

<condition label="0">

 

0 Karma

tonymaibox
New Member

Thanks for the response @tscroggins !

I guess I am/was confused that `<change>` event fires even on init. I thought it would depending on user input first.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...