Hello, I have a dashboard with the following inputs: <fieldset submitButton="true" autoRun="false">
<input type="dropdown" token="tok1" searchWhenChanged="false">
<label>Tok1</label>
<choice value="All">*</choice>
<choice value="Active">Y</choice>
<choice value="Inactive">N</choice>
<prefix>Status="</prefix>
<suffix>"</suffix>
<default>*</default>
<change>
<condition value="All">
<set token="tok1"></set>
</condition>
<condition>
<eval token="tok1">"\" AND upper(STATUS)=upper(\'" + $value$ + "\')\""</eval>
</condition>
</change>
</input>
<input type="text" token="tok2" searchWhenChanged="false">
<label>UserID</label>
<default></default>
<change>
<condition>
<eval token="tok2">if(match($value$,"\\w")," AND UserID=\"*" + upper($value$) + "*\"", "")</eval>
</condition>
</change>
</input>
</fieldset> These two example tokens are user in a panel where the query is just | search * $tok1$ $tok2$ because it refers to another search as base query. The problem is the following: I have a submit button, so I expect that every change in the fields do not trigger the search until I press the Submit button. What happens instead is that, if I change the value of tok1,the search starts, if I change the value of tok2 and then click outside of the text box, the search starts. In both cases, the submit button is bypassed. If I remove tok1 and tok2 manipulations in the <change> tag, everything works as expected, so I guess that the issue is caused by this tag, but I cannot understand the flow that Splunk goes through to decide to bypass the submit button. Thank you very much to anyone who can help me. Have a nice day!
... View more