Hello all,
I've been searching this community up and down and also came of course across @niketn references about it (https://community.splunk.com/t5/Dashboards-Visualizations/Submit-Button-not-working/m-p/387165#M25366).
The all assume that the dashboard/form is "entered" empty. All the sample code I found failed when form already receives values via the URL e.g.
https://community.splunk.com/t5/Dashboards-Visualizations/searchWhenChanged-false-not-honored/td-p/430993
my_form?form.tokDDLogLevel=INFO
<input type="dropdown" token="tokDDLogLevel" searchWhenChanged="false">
<label>Select Log Level</label>
<choice value="INFO">INFO</choice>
<choice value="ERROR">ERROR</choice>
<choice value="WARN">WARN</choice> <initialValue>$form.tokDDLogLevel$</initalValue>
I have 3 dropdowns and 1 textfield expecting 1 to all 4 values to be modifed. When they get prefilled like this it triggers the immediate execution of my search:
<search> | makeresults | eval field1=$tokDDLogLevel$ field2=$...$...</search>
The <initialValue> as well as the <default> seem to trigger the change event immediately without the submit button.
Another example by @dmarling : https://community.splunk.com/t5/Dashboards-Visualizations/In-a-Simple-XML-dashboard-is-it-possible-to-set-a-token-when-a/td-p/428410
<dashboard>
<init>
<set token="query">| makeresults count=1 | eval x= "Yes" | table x</set>
</init>
<label>demodash</label>
<fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="Input1">
<label>Input1</label>
<choice value="A">A</choice>
<choice value="B">B</choice>
</input>
<input type="dropdown" token="Input2">
<label>Input2</label>
<choice value="C">C</choice>
<choice value="D">D</choice>
</input>
</fieldset>
<search>
<query>| makeresults count=1
| eval search=if("A"=$Input1|s$ AND "C"=$Input2|s$, "| makeresults | eval x=\"No\" | table x", "| makeresults | eval x=\"Yes\" | table x")
| table search</query>
<done>
<condition match="$job.doneProgress$=1">
<set token="query">$result.search$</set>
</condition>
</done>
</search>
<row>
<panel>
<table>
<search>
<query>$query$</query>
</search>
</table>
</panel>
</row>
</dashboard>
Now call this dashboard via e.g. "test?form.Input1=A&form.Input2=D" - The query gets built and executed without pressing the Submit button.
BTW, I have the same issue for empty forms where some drop downs are set dynamically via searchOnChange. As soon as all fields have values the query is executed automatically.
This seems to be a particular problem when using forms in combination with makeresults + eval causing the autoRun=false being ignored.
Is there some JavaScript workaround to prevent the form submission until Submit was actually pressed?
(am desperate to even consider turning a checkbox somehow into a submit button and then use "makeresult `comment $checkbox_tok$` the submit button somehow - otherwise only clicking checkbox will once again execute makeresult + eval due to the checkbox, not the Submit button <- any idea how to this nasty hack?)
(Note: using Splunk 7.3.6 which I can't update at the moment)
Thanks guys. Been fighting with this for way too much time already. 😞
... View more
