Splunk Search

<change> event firing before the user ever makes a change to the form input?

tonymaibox
New Member

Hi all, hope all is well!

I'm unsetting a token in the <change> block of a <query>. However, I'm finding that the <unset> event in the <change> block gets fired on initial load before the user ever makes a change to the input. Is this a bug?

Sample code:

<input>
  <search>
    <query>
    </query>
    <change>
      <condition>
        <unset token="some_token"></unset>
      </condition>
    </change>
  </search>
</input>

Labels (1)
0 Karma

tscroggins
Influencer

@tonymaibox 

Your condition has no match attribute, so it will match all events, including form initialization.

For example, foo_tok is cleared on init in this Simple XML:

<form>
  <init>
    <set token="foo_tok">initialized</set>
  </init>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <label>Sample Input</label>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <search>
        <query>| stats count</query>
      </search>
      <change>
        <condition>
          <unset token="foo_tok"></unset>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$foo_tok$</title>
    </panel>
  </row>
</form>

 You can control when unset is invoked by adding constraints to the condition element:

 

<condition label="0">

 

0 Karma

tonymaibox
New Member

Thanks for the response @tscroggins !

I guess I am/was confused that `<change>` event fires even on init. I thought it would depending on user input first.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...