The simpleXML submit button is horribly broken and for complex usecases, cannot be made to work. Try this dahsboard's no-JavaScript approach instead: <form theme="dark">
<label>PoC demonstrating a fully-functioning no-JS SUBMIT "button" (actually "checkbox").</label>
<description>https://community.splunk.com/t5/Dashboards-Visualizations/SimpleXML-Inherent-brokenness-regarding-autorun-and-Submit/m-p/407351 For intricate technical reasons that Splunk considers "working as intended", the "real" SUBMIT button is fundamentally broken and CANNOT BE MADE TO WORK for many usecases (i.e. when you must use "true" for "searchWhenChanged"). Fortunately, the method demonstrated herein does everything that anyone could desire with only 1 downside which is this: there is no way to make the dashboard autorun on first load (not even if you click the CHECKBOX with a URI in the URL). Notice that even though some of the controls interact with one-another, the actual search does not run until the SUBMIT box is checked. Here are the pieces that are required. 1: DO NOT CHANGE ANYTHING ABOUT THE "SUBMIT" checkbox other than cosmetic things (e.g. html). 2: Ensure that EVERY OTHER CONTROL has a "<change>...</change>" section that unsets BOTH these tokens: {"SUBMIT_CHECKBOX", "form.SUBMIT_CHECKBOX"}. 3: Ensure that 1 search in every chain of searches uses the do-nothing "$SUBMIT_CHECKBOX$" token somewhere (i.e. if all searches are driven by a base search, this only has to be done in the base search, not the post-process searches). This token will always be either unset or blank so it does not matter where you put it. 4: Neither the individual "searchWhenChanged" values of the controls NOR the global "Autorun dashboard" value makes any difference. For support contact woodcock@splunxter.com.</description>
<fieldset submitButton="false" autoRun="true">
<input type="multiselect" token="INDEX" searchWhenChanged="true">
<label>Select Index value(s)</label>
<fieldForLabel>label</fieldForLabel>
<fieldForValue>value</fieldForValue>
<default>*</default>
<search>
<query>|tstats count dc(host) WHERE index=* AND $SOURCETYPE$ BY index
| rename index AS value
| eval label = value
| append [|makeresults | eval label = "All", value="*"]
| table label value</query>
<earliest>$timepicker.earliest$</earliest>
<latest>$timepicker.latest$</latest>
</search>
<delimiter> OR index=</delimiter>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(index=</prefix>
<change>
<eval token="form.INDEX">case(mvcount($form.INDEX$) == 2 AND mvindex($form.INDEX$, 0) == "*", mvindex($form.INDEX$, 1), mvfind($form.INDEX$, "^[*]") == mvcount($form.INDEX$) - 1, "*", true(), $form.INDEX$)</eval>
<unset token="SUBMIT_CHECKBOX"></unset>
<unset token="form.SUBMIT_CHECKBOX"></unset>
</change>
<suffix>)</suffix>
</input>
<input type="multiselect" token="SOURCETYPE" searchWhenChanged="true">
<label>Select sourcetype value(s)</label>
<fieldForLabel>label</fieldForLabel>
<fieldForValue>value</fieldForValue>
<default>*</default>
<search>
<query>|tstats count dc(host) WHERE $INDEX$ AND sourcetype=* BY sourcetype
| rename sourcetype AS value
| eval label = value
| append [|makeresults | eval label = "All", value="*"]
| table label value</query>
<earliest>$timepicker.earliest$</earliest>
<latest>$timepicker.latest$</latest>
</search>
<delimiter> OR sourcetype=</delimiter>
<valuePrefix>"</valuePrefix>
<valueSuffix>"</valueSuffix>
<prefix>(sourcetype=</prefix>
<change>
<eval token="form.SOURCETYPE">case(mvcount($form.SOURCETYPE$) == 2 AND mvindex($form.SOURCETYPE$, 0) == "*", mvindex($form.SOURCETYPE$, 1), mvfind($form.SOURCETYPE$, "^[*]") == mvcount($form.SOURCETYPE$) - 1, "*", true(), $form.SOURCETYPE$)</eval>
<unset token="SUBMIT_CHECKBOX"></unset>
<unset token="form.SUBMIT_CHECKBOX"></unset>
</change>
<suffix>)</suffix>
</input>
<input type="text" token="COUNT">
<label>Name for "count" field</label>
<default>count</default>
<change>
<unset token="SUBMIT_CHECKBOX"></unset>
<unset token="form.SUBMIT_CHECKBOX"></unset>
</change>
</input>
<input type="time" token="timepicker" searchWhenChanged="true">
<label>Timepicker</label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
<change>
<unset token="SUBMIT_CHECKBOX"></unset>
<unset token="form.SUBMIT_CHECKBOX"></unset>
</change>
</input>
<input id="submit_checkbox" type="checkbox" token="SUBMIT_CHECKBOX">
<label></label>
<delimiter> </delimiter>
<choice value="">SUBMIT</choice>
</input>
<html depends="$hide$">
<style>
#submit_checkbox{
width:80px !important;
}
#submit_checkbox
div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
width:80px !important;
}
#submit_checkbox button{
padding: 6px 15px !important;
border-radius: 3px !important;
font-weight: 500 !important;
background-color: #5cc05c !important;
border: transparent !important;
color: #fff !important
}
#submit_checkbox button:hover{
background-color: #40a540 !important;
border-color: transparent !important;
}
</style>
</html>
</fieldset>
<row>
<panel>
<table>
<title>Searches ONLY on checking the SUBMIT box (which resets itself)</title>
<search>
<query>|tstats count AS $COUNT|s$ dc(host) WHERE $INDEX$ AND $SOURCETYPE$ BY index sourcetype $SUBMIT_CHECKBOX$</query>
<earliest>$timepicker.earliest$</earliest>
<latest>$timepicker.latest$</latest>
</search>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
... View more