All Apps and Add-ons

Prevent autorun of an upstream base search when setting filters for downstream postprocess

chrisX
Engager

Dear Splunk Community,

I have a dashboard with a base search that aggregates data and takes a bit to run. "Underneath" it are supposed to be a few pulldown modules to filter the following postprocesses.
I would like the base search only to run when the dashboard is loaded, but not to rerun when the downstream pulldown values are selected.
Here only the postprocesses should rerun/autorun.

Any advice on how to achieve that or how to explain my problem more clearly is greatly appreciated.

Thanks in advance,

C

Here my simplified samplecode:

<module name="Search" autoRun="True">
 <param name="search"> my Base Search
 </param>

 <module name="Pulldown">
  <param name="label">PulldownFilter</param>
  <param name="name">Filter</param>

  <module name="PostProcess" autoRun="True">
   <param name="search"> my PostProcessSearch $Filter$
   </param>

   <module name="HiddenChartFormatter"> ...

    <module name="FlashChart"...
    </module>
   </module>
  </module>
 </module>
</module>   

sideview
SplunkTrust
SplunkTrust

I would use a Button module, and set these params on that Button moduile.

 <param name="allowAutoSubmit">True</param>
 <param name="allowSoftSubmit">False</param>

The first one only affects the module at page-load time, and tells the Button to let a push through if the page is loading. The second param only takes affect after page-load-time and tells the module that if a push comes down, do not let it through. The user will then have to click the green button in order to push downstream from the button.

0 Karma

chrisX
Engager

Thanks for your input. Below or above which module would you put the button? Plus I seem to have mixed up what downstream/upstream means...??? My intention is that the child modules (downstream?) of my filters rerun automatically but the parent base search (upstream?) does not. Your answer sounds like the user has to press the button to reload the (downstream?) postprocesses or am I missing something? Thanks

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...