Dashboards & Visualizations

searchWhenChanged=false not honored?

nick405060
Motivator

Hey guys,

I have an issue where searchWhenChanged=false is not being honored. I have a fieldset with 5 inputs all set to false, but occasionally for four of the inputs, those inputs will still execute a search when changed without the submit button being pressed. This only occurs after one initial search has been executed. The fifth input, shown in its entirety here, will execute the search when changed every time without exception.

<input type="text" token="search" searchWhenChanged="false">
  <label>First Last or ID (*'s accepted)</label>
  <default></default>
</input>

I've changed the token name in case $search$ is reserved without any difference. The token $search$ is only being used in an invisible inputs query inside fieldset which generates basically "global variables" for a bunch of different panels in my dashboard.

<input type="dropdown" depends="$justHideMe$">
  <search>
    <query>
index=MY_HR_DATABASE | eval search="$search$" | rex field=search "^(?&lt;first&gt;\S+?)\s+?(?&lt;last&gt;\S+)$|^(?&lt;id&gt;[\s\S]+)$" | REST OF QUERY
    </query>
    <earliest>-24h</earliest>
    <latest>now</latest>
    <finalized>
      <set token="lastfirst">$result.LastFirst$</set>
      <set token="networkid">$result.NetworkId$</set>
      <set token="email">$result.Email$</set>
    </finalized>
  </search>
</input>

However if I move the entire stanza outside of fieldset to just be an ad-hoc query, the same problem occurs. I've viewed multiple SA posts that are very informative regarding this issue like https://answers.splunk.com/answers/679596/what-is-the-expected-behavior-for-submit-button-wh.html and https://answers.splunk.com/answers/681772/adding-evaluated-token-breaks-searchwhenchangedfal.html and https://answers.splunk.com/answers/542126/submit-button-not-passing-tokens.html, but to date I have not been able to implement a fix.

0 Karma
1 Solution

niketn
Legend

@nick405060 Interesting issue, while I can't give a fix, following is a workaround that you can try to overcome this "tricky" situation:

Create a hidden text input where the <default> value is set using the token from <change> event handler of actual input. Then use the hidden input's token in the search. This way a dummy dependency of clicking the Submit button will be added to the value set in the dropdown input's token set via change event handler.

Following is the run anywhere example which has

1) Input dropdown with searchWhenChanged="false" and dropdown input form token as $tokDDLogLevel$.
2) Input dropdown's <change> event handler that sets a token $tokLogLevelOnChange$ (for test's simplicity purpose same as dropdown's $value$).
3) A hidden text box input which uses the change event handler token as default value and sets the form level text box input as $tokLogLevelOnSubmit$
4) Creates three panels running same search with $tokDDLogLevel$ (panel 1), $tokLogLevelOnChange$ (panel 2) and $tokLogLevelOnSubmit$ (panel 3).

Panel 2 is used to recreate the issue where token $tokLogLevelOnChange$ is changed immediately on change of dropdown value, without even clicking on Submit button.

and Panel 3 is the solution workaround which set the token value from $tokLogLevelOnChange$ to a hidden text box and runs the search only is Submit button is clicked i.e. $tokLogLevelOnSubmit$ is submitted.

Behavior of 2nd panel when Dropdown is changed (issue)

alt text

Behavior of 3rd panel when Submit button is clicked (workaround)

alt text

<form>
  <label>Default Token on change to be used in Search with searchWhenChanged false</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="tokDDLogLevel" searchWhenChanged="false">
      <label>Select Log Level</label>
      <choice value="INFO">INFO</choice>
      <choice value="ERROR">ERROR</choice>
      <choice value="WARN">WARN</choice>
      <change>
        <set token="tokLogLevelOnChange">$value$</set>
      </change>
    </input>
    <input type="text" token="tokLogLevelOnSubmit" searchWhenChanged="false" depends="$hiddenInputForAddingSubmitDependencyForChangeEventHandler$">
      <default>$tokLogLevelOnChange$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Refreshes only on Submit</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokDDLogLevel$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown Form Input token with <code>searchWhenChanged=false</code>
        </div>
        <div>tokDDLogLevel: <b>$tokDDLogLevel$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes without Submit (ISSUE, second time onward)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnChange$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown <code>change</code> Event Handler Token</div>
        <div>tokLogLevelOnChange: <b>$tokLogLevelOnChange$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes only on Submit (FIX)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnSubmit$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the <code>hidden textbox</code> token set via change event handler token of the dropdown to add Submit Token Model dependency</div>
        <div>$tokLogLevelOnSubmit$: <b>$tokLogLevelOnSubmit$</b>
        </div>
      </html>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

woodcock
Esteemed Legend

The simpleXML submit button is horribly broken and for complex usecases, cannot be made to work.  Try this dahsboard's no-JavaScript approach instead:

 

<form theme="dark">
  <label>PoC demonstrating a fully-functioning no-JS SUBMIT "button" (actually "checkbox").</label>
  <description>https://community.splunk.com/t5/Dashboards-Visualizations/SimpleXML-Inherent-brokenness-regarding-autorun-and-Submit/m-p/407351  For intricate technical reasons that Splunk considers "working as intended", the "real" SUBMIT button is fundamentally broken and CANNOT BE MADE TO WORK for many usecases (i.e. when you must use "true" for "searchWhenChanged").  Fortunately, the method demonstrated herein does everything that anyone could desire with only 1 downside which is this: there is no way to make the dashboard autorun on first load (not even if you click the CHECKBOX with a URI in the URL).  Notice that even though some of the controls interact with one-another, the actual search does not run until the SUBMIT box is checked.  Here are the pieces that are required. 1: DO NOT CHANGE ANYTHING ABOUT THE "SUBMIT" checkbox other than cosmetic things (e.g. html).  2: Ensure that EVERY OTHER CONTROL has a "&lt;change&gt;...&lt;/change&gt;" section that unsets BOTH these tokens: {"SUBMIT_CHECKBOX", "form.SUBMIT_CHECKBOX"}.  3: Ensure that 1 search in every chain of searches uses the do-nothing "$SUBMIT_CHECKBOX$" token somewhere (i.e. if all searches are driven by a base search, this only has to be done in the base search, not the post-process searches).  This token will always be either unset or blank so it does not matter where you put it.  4: Neither the individual "searchWhenChanged" values of the controls NOR the global "Autorun dashboard" value makes any difference.  For support contact woodcock@splunxter.com.</description>
  <fieldset submitButton="false" autoRun="true">
    <input type="multiselect" token="INDEX" searchWhenChanged="true">
      <label>Select Index value(s)</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <default>*</default>
      <search>
        <query>|tstats count dc(host) WHERE index=* AND $SOURCETYPE$ BY index
| rename index AS value
| eval label = value
| append [|makeresults | eval label = "All", value="*"]
| table label value</query>
        <earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>
      </search>
      <delimiter> OR index=</delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <prefix>(index=</prefix>
      <change>
        <eval token="form.INDEX">case(mvcount($form.INDEX$) == 2 AND mvindex($form.INDEX$, 0) == "*", mvindex($form.INDEX$, 1), mvfind($form.INDEX$, "^[*]") == mvcount($form.INDEX$) - 1, "*", true(), $form.INDEX$)</eval>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
      <suffix>)</suffix>
    </input>
    <input type="multiselect" token="SOURCETYPE" searchWhenChanged="true">
      <label>Select sourcetype value(s)</label>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>value</fieldForValue>
      <default>*</default>
      <search>
        <query>|tstats count dc(host) WHERE $INDEX$ AND sourcetype=* BY sourcetype
| rename sourcetype AS value
| eval label = value
| append [|makeresults | eval label = "All", value="*"] 
| table label value</query>
        <earliest>$timepicker.earliest$</earliest>
        <latest>$timepicker.latest$</latest>
      </search>
      <delimiter> OR sourcetype=</delimiter>
      <valuePrefix>"</valuePrefix>
      <valueSuffix>"</valueSuffix>
      <prefix>(sourcetype=</prefix>
      <change>
        <eval token="form.SOURCETYPE">case(mvcount($form.SOURCETYPE$) == 2 AND mvindex($form.SOURCETYPE$, 0) == "*", mvindex($form.SOURCETYPE$, 1), mvfind($form.SOURCETYPE$, "^[*]") == mvcount($form.SOURCETYPE$) - 1, "*", true(), $form.SOURCETYPE$)</eval>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
      <suffix>)</suffix>
    </input>
    <input type="text" token="COUNT">
      <label>Name for "count" field</label>
      <default>count</default>
      <change>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
    </input>
    <input type="time" token="timepicker" searchWhenChanged="true">
      <label>Timepicker</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
      <change>
        <unset token="SUBMIT_CHECKBOX"></unset>
        <unset token="form.SUBMIT_CHECKBOX"></unset>
      </change>
    </input>
    <input id="submit_checkbox" type="checkbox" token="SUBMIT_CHECKBOX">
      <label></label>
      <delimiter> </delimiter>
      <choice value="">SUBMIT</choice>
    </input>
    <html depends="$hide$">
      <style>
        #submit_checkbox{
          width:80px !important;
        }
        #submit_checkbox
div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
          width:80px !important;
        }
        #submit_checkbox  button{
          padding: 6px 15px !important;
          border-radius: 3px !important;
          font-weight: 500 !important;
          background-color: #5cc05c !important;
          border: transparent !important;
          color: #fff !important
        }
        #submit_checkbox  button:hover{
          background-color: #40a540 !important;
          border-color: transparent !important;
        }
    </style>
  </html>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Searches ONLY on checking the SUBMIT box (which resets itself)</title>
        <search>
          <query>|tstats count AS $COUNT|s$ dc(host) WHERE $INDEX$ AND $SOURCETYPE$ BY index sourcetype $SUBMIT_CHECKBOX$</query>
          <earliest>$timepicker.earliest$</earliest>
          <latest>$timepicker.latest$</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

 

acustomer
Explorer

Nice workaround.

0 Karma

nick405060
Motivator

I am posting another answer to this question as a tl;dr version of @niketnilay's answer. ALL credit goes entirely to him.

<fieldset submitButton="true" autoRun="false">
  <input type="text" searchWhenChanged="false">
    <default></default>
    <change>
      <set token="searchOnChange">$value$</set>
    </change>
  </input>
  <input type="text" token="searchOnSubmit" depends="$justHideMe$">
    <default>$searchOnChange$</default>
  </input>
</fieldset>

niketn
Legend

@nick405060, I think what you have posted here is the exact use case I have explained in my example as well. Only difference is that my main input is a dropdown rather than a textbox. Nevertheless, I am glad that finally your issue is resolved! Keep Splunking 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sahiljindal290
New Member

HI @nick405060 @niketnilay

I am also facing the same issue that you guys have provided. Before hitting the submit button, it is showing me the corresponding result. Can you please help me? I have tried various solutions which are provided on Splunk QA.

https://answers.splunk.com/answers/742451/searchwhenchangedfalse-not-honored-1.html
https://answers.splunk.com/answers/679596/what-is-the-expected-behavior-for-submit-button-wh.html

My sample code:-

<input type="time" token="Time" searchWhenChanged="false">
  <label>Time Picker</label>
  <default>
    <earliest>@d</earliest>
    <latest>now</latest>
  </default>
</input>
<input type="dropdown" token="APPLICATION" searchWhenChanged="false">
  <label>APPLICATION</label>
  <choice value="svc-logisticsdm-mlo">svc-logisticsdm-mlo</choice>
  <choice value="svc-logistics-bookings">svc-logistics-bookings</choice>
  <choice value="svc-logix-loms-status-updates">svc-logix-loms-status-updates</choice>
  <choice value="svc-logix-loms-create-order">svc-logix-loms-create-order</choice>
  <choice value="svc-logix-stock-check-uat">svc-logix-stock-check-uat</choice>
  <default>svc-logistics-bookings</default>
  <change>
    <set token="tokLogLevelOnChange">$value$</set>
  </change>
</input>
<input type="text" token="tokLogLevelOnSubmit" searchWhenChanged="false" depends="$justHideMe$">
  <label>searchOnSubmit</label>
  <change>
    <condition value="svc-logistics-bookings">
      <unset token="logisticsdm"></unset>
      <unset token="status-updates"></unset>
      <unset token="create-order"></unset>
      <unset token="stock-check"></unset>
      <set token="bookings"></set>
    </condition>
    <condition value="svc-logix-stock-check-uat">
      <unset token="logisticsdm"></unset>
      <unset token="status-updates"></unset>
      <unset token="create-order"></unset>
      <unset token="bookings"></unset>
      <set token="stock-check"></set>
    </condition>
    <condition value="create-order">
      <unset token="logisticsdm"></unset>
      <unset token="status-updates"></unset>
      <unset token="bookings"></unset>
      <unset token="stock-check"></unset>
      <set token="create-order"></set>
    </condition>
    <condition value="svc-logix-loms-status-updates">
      <unset token="logisticsdm"></unset>
      <unset token="stock-check"></unset>
      <unset token="create-order"></unset>
      <unset token="bookings"></unset>
      <set token="status-updates"></set>
    </condition>
    <condition value="svc-logisticsdm-mlo">
      <unset token="create-order"></unset>
      <unset token="status-updates"></unset>
      <unset token="bookings"></unset>
      <unset token="stock-check"></unset>
      <set token="logisticsdm"></set>
    </condition>
  </change>
  <default>$tokLogLevelOnChange$</default>
</input>

Any kind of help would be appreciated.

0 Karma

niketn
Legend

@nick405060 Interesting issue, while I can't give a fix, following is a workaround that you can try to overcome this "tricky" situation:

Create a hidden text input where the <default> value is set using the token from <change> event handler of actual input. Then use the hidden input's token in the search. This way a dummy dependency of clicking the Submit button will be added to the value set in the dropdown input's token set via change event handler.

Following is the run anywhere example which has

1) Input dropdown with searchWhenChanged="false" and dropdown input form token as $tokDDLogLevel$.
2) Input dropdown's <change> event handler that sets a token $tokLogLevelOnChange$ (for test's simplicity purpose same as dropdown's $value$).
3) A hidden text box input which uses the change event handler token as default value and sets the form level text box input as $tokLogLevelOnSubmit$
4) Creates three panels running same search with $tokDDLogLevel$ (panel 1), $tokLogLevelOnChange$ (panel 2) and $tokLogLevelOnSubmit$ (panel 3).

Panel 2 is used to recreate the issue where token $tokLogLevelOnChange$ is changed immediately on change of dropdown value, without even clicking on Submit button.

and Panel 3 is the solution workaround which set the token value from $tokLogLevelOnChange$ to a hidden text box and runs the search only is Submit button is clicked i.e. $tokLogLevelOnSubmit$ is submitted.

Behavior of 2nd panel when Dropdown is changed (issue)

alt text

Behavior of 3rd panel when Submit button is clicked (workaround)

alt text

<form>
  <label>Default Token on change to be used in Search with searchWhenChanged false</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="tokDDLogLevel" searchWhenChanged="false">
      <label>Select Log Level</label>
      <choice value="INFO">INFO</choice>
      <choice value="ERROR">ERROR</choice>
      <choice value="WARN">WARN</choice>
      <change>
        <set token="tokLogLevelOnChange">$value$</set>
      </change>
    </input>
    <input type="text" token="tokLogLevelOnSubmit" searchWhenChanged="false" depends="$hiddenInputForAddingSubmitDependencyForChangeEventHandler$">
      <default>$tokLogLevelOnChange$</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Refreshes only on Submit</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokDDLogLevel$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown Form Input token with <code>searchWhenChanged=false</code>
        </div>
        <div>tokDDLogLevel: <b>$tokDDLogLevel$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes without Submit (ISSUE, second time onward)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnChange$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the Dropdown <code>change</code> Event Handler Token</div>
        <div>tokLogLevelOnChange: <b>$tokLogLevelOnChange$</b>
        </div>
      </html>
    </panel>
    <panel>
      <table>
        <title>Refreshes only on Submit (FIX)</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevelOnSubmit$"
| stats count by component            
          </query>
        </search>
      </table>
      <html>
        <div>Uses the <code>hidden textbox</code> token set via change event handler token of the dropdown to add Submit Token Model dependency</div>
        <div>$tokLogLevelOnSubmit$: <b>$tokLogLevelOnSubmit$</b>
        </div>
      </html>
    </panel>
  </row>
</form>

Please try out and confirm!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

nick405060
Motivator

Unfortunately this is not a complete workaround. This code will demonstrate (copy and pasteable):

<form>
  <label>User Activity</label>

  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="tokFormInputTextBox" searchWhenChanged="false">
      <label>First Last or ID (*'s accepted)</label>
      <default></default>
      <change>
        <set token="searchOnChange">$value$</set>
      </change>
    </input>
    <input type="text" token="searchOnSubmit" depends="$justHideMe$">
      <default>$searchOnChange$</default>
    </input>
    <input type="dropdown" token="tokFormInputDropdown">
      <search>
        <query>
| makeresults | eval NetworkId="$searchOnSubmit$" | table NetworkId
            </query>
        <earliest>-24h</earliest>
        <latest>now</latest>
        <done>
          <set token="lastfirst">$result.LastFirst$</set>
          <set token="networkid">$result.NetworkId$</set>
          <set token="email">$result.Email$</set>
        </done>
      </search>
      <fieldForLabel>LastFirst</fieldForLabel>
      <fieldForValue>Email</fieldForValue>
    </input>
    <input type="text" token="networkIDOnSubmit" depends="$justHideMe$">
      <default>$networkid$</default>
    </input>
  </fieldset>

  <row>
    <panel>
      <title>Sessions:</title>
      <table>
        <search>
          <query>
    | makeresults | eval a="$networkIDOnSubmit$" | table a
              </query>
        </search>
        <option name="count">10</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>

</form>

As you can tell, you cannot enter a value in the search box and then press submit. You need to unfocus from the search box, wait a second for it to populate (which you can visually see!), and then press submit (or press submit once, wait a second, and then press it again, but there are some major downsides to this second approach).

How do I fix this so that I can use a search box, conditional/change tokens, and a submit button?

0 Karma

nick405060
Motivator

I fixed it! I am adding this as a second comment instead of removing the above comment, though, in case you have any interest in exploring why the above situation occurred. I think there are going to be situations where the same thing is going to occur for other users, where they can't implement my fix below? Honestly I am not 100% sure though, this is complicated lol.

Anyways, for ME my fix was just to move the dropdown (originally a hidden dropdown, if you remember) outside of fieldset to be an ad-hoc search. Why I was using a hidden dropdown and not an ad-hoc search to begin with is a long story, but if you remember from the usergroups conversation, I had tried converting to an ad-hoc search many times without any success fixing this issue. Once you so helpfully told me your solution in usergroups (the below solution)

 <input type="text" token="tokFormInputTextBox" searchWhenChanged="false">
   <label>First Last or ID (*'s accepted)</label>
   <default></default>
   <change>
     <set token="searchOnChange">$value$</set>
   </change>
 </input>
 <input type="text" token="searchOnSubmit" depends="$justHideMe$">
   <default>$searchOnChange$</default>
 </input>

then it was able to correctly fix the problem in conjunction with moving the hidden dropdown to an ad-hoc search (plus changing finalized to done, idk if that helped). Thank you once again!!!!!!! 16 aggregate hours later lol

nick405060
Motivator

Edit: for anyone viewing this, I believe there is another (possible, if not outdated) solution here:

https://answers.splunk.com/answers/548647/enhancement-request-make-change-conditional-tokens.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...