I currently have a form is simplexml with a text box and submit button. When search is run on user entered query, the user can do a dynamic drill down on the results and have a new table appear next to the original table. To achieve this, I did something like this:
<form>
<fieldset autoRun="False" submitButton="true">
<input type="text" token="qtoken">
</input>
</fieldset>
<row>
<panel>
<table>
<searchString>index=blacklists sourcetype="malicious_ip" addr=$qtoken$|table _time, sourcetype, category,notes</searchString>
<option name="drilldown">row</option>
<drilldown>
<set toke="category">"$row.category$"</set>
</drilldown>
</table>
</panel>
<panel>
<table depends="$category$">
<searchString>index=blacklists sourcetype="malicious_ip" CC="US" addr=$category$|table _time, sourcetype, notes</searchString>
</table>
</panel>
</row>
</form>
This work but I want to make the second table gone when a new search is ran i.e when the submitButton is clicked, unless there is a better way. Right now, I have to refresh the browser to make it disappear or do a new drilldown on the new search to have it's content replaced.
Add a searchWhenChanged="true" in your text box. :
<input type="text" token="qtoken" searchWhenChanged="true">
Unfortunately, adding searchWhenChanged="true" didn't change anything.