Splunk Search

How to disable a search for a dashboard panel?

avilandau
Path Finder

I have a dashboard (really a form) with few panels each doing a search and export and several input fields each (all set to some default so they are not always change and are ready for a search even if the user is not changing any of them). All items have searchonchange set to false so the user makes all the input before pushing submit. My goal is to enable the user to skip a few of the searches. I could hide each panel with checkbox at the top and use "depends" in the panel, but that only hides the panel. The search still runs when I click the submit. How can I disable the search itself?

Tags (3)

anantdeshpande
Path Finder

Hi Avilandau,

Did you get the solution? I am having similar issue. Panel is getting hide but that query of hidden panel always run in background. I want to avoid that.

0 Karma

bwlm
Path Finder

I have the same problem... In my case I am trying to have both a "dry run" and "update" option to the search.
1) I tried disabling / enabling the panel "view" but that did not work. https://answers.splunk.com/answers/639048/how-to-make-panel-depend-on-token-value.html
2) I also tried changing the function of my "final Search" (last line in my search query) to a "dry run: dummy search string" and the "update: append to lookuptable". It seems that since this changes the "search query itself" -- the panel search query gets rerun -- even though the "Submit" button has not been selected. All other form input fields (note: 'search on change' is disabled for all) simply change variables rather than search queries themselves though.

On my dropdown input, it seems explicitly stating searchWhenChanged="false" does help.

<fieldset submitButton="true" autoRun="false">
    <input type="dropdown" token="input-dryrunORupdate" searchWhenChanged="false" >
      <label>DryRun or Update</label>
      <choice value="DryRun">DryRun</choice>
      <choice value="Update">Update</choice>
      <change>
        <condition value="DryRun">
          <set token="tokFinalSearch">eval x=y | fields - x</set>
        </condition>
        <condition value="Update">
          <set token="tokFinalSearch">outputlookup append=true access-events.csv</set>
        </condition>
      </change>
      <default>DryRun</default>
      <initialValue>DryRun</initialValue>
    </input>
  <!-- ... more inputs ... -->
</fieldset>

The last line of my panel search query is:

| $tokFinalSearch$
0 Karma

niketn
Legend

@anantdeshpande, One workaround would be if your input tokens are input1, input2, input3 etc. would be to include the same in your search (possibly after the final transforming to display your results)

| eval dummyField=$input1$.$input2$.$input3$
| fields - dummyField
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

anantdeshpande
Path Finder

Hi,
I tried using dummy token from drop down value itself . As I am using * as default value in all filter criteria.
This dummy token will get value as * and search will run. Also I am using change condition flag to show/hide panel. So problem is still there that whenever token is getting set from drop down, all queries will run with default values.

0 Karma

stephane_cyrill
Builder

Hi avilandau, Let propose an other approach to you: Building a form with a dropdown that content all your searches So the user can choose the one he want to run .
to do that:
1- you use savedsearches at the place of each panel query.

2- you populate the dropdown with the names of your savedsearches(using choice tag)

3-In the searchString tag you put |savedsearch $token_of_the_dropdown$ ..............

4- doing so only one query will be run at a time.

5- NOTE:if you want to run more than one query or have more than one pane, you can simply put input dropdown in each panels.

0 Karma

chimell
Motivator

Hi avilandau
It is better for you to delete this panel in your dashboard search code instead of search the way to disable the panel.

0 Karma

avilandau
Path Finder

I guess you didn't get my point. I want to have a checkbox on the screen that control when to disable it and when to have it (i.e. I don't need to get rid of it I just need to have it dynamic per user decision).

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...