All Apps and Add-ons

Prevent autorun of an upstream base search when setting filters for downstream postprocess

chrisX
Engager

Dear Splunk Community,

I have a dashboard with a base search that aggregates data and takes a bit to run. "Underneath" it are supposed to be a few pulldown modules to filter the following postprocesses.
I would like the base search only to run when the dashboard is loaded, but not to rerun when the downstream pulldown values are selected.
Here only the postprocesses should rerun/autorun.

Any advice on how to achieve that or how to explain my problem more clearly is greatly appreciated.

Thanks in advance,

C

Here my simplified samplecode:

<module name="Search" autoRun="True">
 <param name="search"> my Base Search
 </param>

 <module name="Pulldown">
  <param name="label">PulldownFilter</param>
  <param name="name">Filter</param>

  <module name="PostProcess" autoRun="True">
   <param name="search"> my PostProcessSearch $Filter$
   </param>

   <module name="HiddenChartFormatter"> ...

    <module name="FlashChart"...
    </module>
   </module>
  </module>
 </module>
</module>   

sideview
SplunkTrust
SplunkTrust

I would use a Button module, and set these params on that Button moduile.

 <param name="allowAutoSubmit">True</param>
 <param name="allowSoftSubmit">False</param>

The first one only affects the module at page-load time, and tells the Button to let a push through if the page is loading. The second param only takes affect after page-load-time and tells the module that if a push comes down, do not let it through. The user will then have to click the green button in order to push downstream from the button.

0 Karma

chrisX
Engager

Thanks for your input. Below or above which module would you put the button? Plus I seem to have mixed up what downstream/upstream means...??? My intention is that the child modules (downstream?) of my filters rerun automatically but the parent base search (upstream?) does not. Your answer sounds like the user has to press the button to reload the (downstream?) postprocesses or am I missing something? Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...