Dashboards & Visualizations

Simple XML: How to keep dashboard from auto running

jedatt01
Builder

I've seen quite a few posts about this topic but no answers. I have some simple xml dashboards with imbedded searches, and a time picker but I only want the search to run when the user actually clicks the submit button after choosing from the time picker. Currently the searches automatically run onload is there a way to stop this behavior? setting autoRun="false" does not work.

r_ladner_1_ctr
Engager

I set fieldset submitButton=false", set the inputs to searchWhenChanged="false".
I added a checkbox: token="Done" searchWhenChanged="true"; no label; value=""; and made the visible choice: Go.
So the user sees a checkbox whose only choice is "Go". It replaces the submit button.
At the beginning of the search, I placed this variable: $Done$.
So when another form submits to this page, Done doesn't exist, and the form waits for the user to check the Go option: the only option.
When the user clicks the checkbox, Done exists as the empty string; so, it does not interfere with the search and the search can proceed.
If the user clicks the checkbox again, unchecking it, Done does not exist, so, nothing happens.
[If the user clicks the checkbox yet again, setting it a second time, the action will occur.]

jclyde
Explorer

In addition to this:

<fieldset autorun="false" submitButton="true">

Make sure if you have input fields that you have the searchWhenChanged="false" tag set on each of them:

<input type="dropdown" token="source_ip" searchWhenChanged="false">

MaverickT
Communicator

I am stuck with same issue, unfortunately your solution doesn't work for us. It looks like autorun="false" is overriden if we have search that is populating dropdown choices. I know that search that is populating dropdown should start with autorun, but the others shouldn't. Is there any usefull workaround for this issue?

sansay
Contributor

I don't understand why this solution doesn't work for you. It's simple and it works with every dashboard I used it on. Please post your code so we can try to determine why it doesn't work.

0 Karma

vcgamesii
Explorer

This worked after I cleared my browser cache.

0 Karma

sansay
Contributor

I don't know what you did that prevents it from working but, here is an example dashboard which does exactly what you want. The searches won't run until you click on the Submit button. Each panel shows message "Search is waiting for input..."

Just replace the terms of the search with something that will find data.

<form>
  <label>TEST</label>
  <fieldset autorun="0" submitButton="true">
    <input type="time" token="time_tok">
      <label/>
      <default>
        <earliestTime>-4h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>  
  <row>
    <panel>
      <event>
       <earliestTime>$time_tok.earliest$</earliestTime>
        <latestTime>$time_tok.latest$</latestTime>
        <searchString>index=np_db source="dbmon-tail://SPLUNK_PRD/get_account_detail"</searchString>
      </event>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>get account details</title>
        <searchString>index=np_db source="dbmon-tail://SPLUNK_PRD/get_account_detail" | timechart span=10m values(AVG_TOTAL_TIME_PER_CALL)</searchString>
        <earliestTime>$time_tok.earliest$</earliestTime>
        <latestTime>$time_tok.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

jedatt01
Builder

I found another question that answers how to band-aid the issue by adding a form input requirement in the query that really does nothing. http://answers.splunk.com/answers/129853/splunk-6-form-search-query-is-running-on-form-load.html. But that doesn't really answer why autoRun="false" does not a stop searches from automatically running onload. Anyone know?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...