Hello, I have multiple dashboards where i user loadjob command since it is very useful to recycle big search results that need to be manipulated in other searches. I know that unscheduled jobs have a default TTL of 10 minutes and I don't want to change their default TTL globally in the system. Why I'm asking this question: if a User access a dashboard with the loadjob command in the code for example at 10AM and then he comes back to the dashboard at 10:15AM I don't want him to see a message about the non existence of the job (like 'Cannot load artifact' or something like this). To prevent this, I want to create a javascript that recovers the job Id that the User search generated and every 9 minutes increments its TTL by 10 minutes. So the javascript will have a loop where it will wait 9 minutes and change the job id TTL over and over again until the User closes the dashboard (only at that moment I'll let the job expire after 10 minutes so I don't overload the disk). So, the question is: if I have a job id X, how can I increment only its TTL by adding 10 minutes to it? Is there an SPL command? And how can I launch it from a Javascript? Thank you very much to anyone who'll help! ... View more

Hello, I have a dashboard with the following inputs:   <fieldset submitButton="true" autoRun="false"> <input type="dropdown" token="tok1" searchWhenChanged="false"> <label>Tok1</label> <choice value="All">*</choice> <choice value="Active">Y</choice> <choice value="Inactive">N</choice> <prefix>Status="</prefix> <suffix>"</suffix> <default>*</default> <change> <condition value="All"> <set token="tok1"></set> </condition> <condition> <eval token="tok1">"\" AND upper(STATUS)=upper(\'" + $value$ + "\')\""</eval> </condition> </change> </input> <input type="text" token="tok2" searchWhenChanged="false"> <label>UserID</label> <default></default> <change> <condition> <eval token="tok2">if(match($value$,"\\w")," AND UserID=\"*" + upper($value$) + "*\"", "")</eval> </condition> </change> </input> </fieldset>   These two example tokens are user in a panel where the query is just   | search * $tok1$ $tok2$   because it refers to another search as base query. The problem is the following: I have a submit button, so I expect that every change in the fields do not trigger the search until I press the Submit button. What happens instead is that, if I change the value of tok1,the search starts, if I change the value of tok2 and then click outside of the text box, the search starts. In both cases, the submit button is bypassed. If I remove tok1 and tok2 manipulations in the <change> tag, everything works as expected, so I guess that the issue is caused by this tag, but I cannot understand the flow that Splunk goes through to decide to bypass the submit button. Thank you very much to anyone who can help me. Have a nice day! ... View more