Splunk Search

<change> event firing before the user ever makes a change to the form input?

tonymaibox
New Member

Hi all, hope all is well!

I'm unsetting a token in the <change> block of a <query>. However, I'm finding that the <unset> event in the <change> block gets fired on initial load before the user ever makes a change to the input. Is this a bug?

Sample code:

<input>
  <search>
    <query>
    </query>
    <change>
      <condition>
        <unset token="some_token"></unset>
      </condition>
    </change>
  </search>
</input>

Labels (1)
0 Karma

tscroggins
Influencer

@tonymaibox 

Your condition has no match attribute, so it will match all events, including form initialization.

For example, foo_tok is cleared on init in this Simple XML:

<form>
  <init>
    <set token="foo_tok">initialized</set>
  </init>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <label>Sample Input</label>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <search>
        <query>| stats count</query>
      </search>
      <change>
        <condition>
          <unset token="foo_tok"></unset>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$foo_tok$</title>
    </panel>
  </row>
</form>

 You can control when unset is invoked by adding constraints to the condition element:

 

<condition label="0">

 

0 Karma

tonymaibox
New Member

Thanks for the response @tscroggins !

I guess I am/was confused that `<change>` event fires even on init. I thought it would depending on user input first.

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...