Splunk Search

<change> event firing before the user ever makes a change to the form input?

tonymaibox
New Member

Hi all, hope all is well!

I'm unsetting a token in the <change> block of a <query>. However, I'm finding that the <unset> event in the <change> block gets fired on initial load before the user ever makes a change to the input. Is this a bug?

Sample code:

<input>
  <search>
    <query>
    </query>
    <change>
      <condition>
        <unset token="some_token"></unset>
      </condition>
    </change>
  </search>
</input>

0 Karma

tscroggins
Influencer

@tonymaibox 

Your condition has no match attribute, so it will match all events, including form initialization.

For example, foo_tok is cleared on init in this Simple XML:

<form>
  <init>
    <set token="foo_tok">initialized</set>
  </init>
  <label>Test</label>
  <fieldset submitButton="false">
    <input type="multiselect" token="field1" searchWhenChanged="true">
      <label>Sample Input</label>
      <fieldForLabel>count</fieldForLabel>
      <fieldForValue>count</fieldForValue>
      <search>
        <query>| stats count</query>
      </search>
      <change>
        <condition>
          <unset token="foo_tok"></unset>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>$foo_tok$</title>
    </panel>
  </row>
</form>

 You can control when unset is invoked by adding constraints to the condition element:

 

<condition label="0">

 

0 Karma

tonymaibox
New Member

Thanks for the response @tscroggins !

I guess I am/was confused that `<change>` event fires even on init. I thought it would depending on user input first.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...