Splunk Search

<change> event firing before the user ever makes a change to the form input?

tonymaibox
New Member

Hi all, hope all is well!

I'm unsetting a token in the <change> block of a <query>. However, I'm finding that the <unset> event in the <change> block gets fired on initial load before the user ever makes a change to the input. Is this a bug?

Sample code:

<input>
  <search>
    <query>
    </query>
    <change>
      <condition>
        <unset token="some_token"></unset>
      </condition>
    </change>
  </search>
</input>

Labels (1)
0 Karma

tscroggins
Influencer

@tonymaibox 

Your condition has no match attribute, so it will match all events, including form initialization.

For example, foo_tok is cleared on init in this Simple XML:

<form>
  <init>
    <set token="foo_tok">initialized</set>
  </init>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <label>Sample Input</label>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <search>
        <query>| stats count</query>
      </search>
      <change>
        <condition>
          <unset token="foo_tok"></unset>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$foo_tok$</title>
    </panel>
  </row>
</form>

 You can control when unset is invoked by adding constraints to the condition element:

 

<condition label="0">

 

0 Karma

tonymaibox
New Member

Thanks for the response @tscroggins !

I guess I am/was confused that `<change>` event fires even on init. I thought it would depending on user input first.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...