Dashboards & Visualizations

Splunk 6.5.0 simple XML: searchWhenChanged=false not honored in input panels outside of "fieldset"

BorisGrochalski
Explorer

I noticed in 6.5.0 (and 6.5.1) that the "searchWhenChanged=false" attribute is not honored for input panels outside of "fieldset".
I have quite a few dashboards where I have input panels on top of the dashboard (in the "fieldset") as well as in panels themelves, all with a default value, with "searchWhenChanged=false" as well as "autoRun=false" and "submitButton=true" in .
All those dashboards now run on the loading of the page with the default values, which I don't want.

My workaround right now is to disable some or all default values in the inputs. This prevents the autorun on first load, but as soon as I change a value in the input panels outside of "fieldset" the searches containing the tokens of the input field run again.

Is this expected behaviour? And are there other ways to restore the functionality of the "searchWhenChanged=false" for input panels outside of "fieldset"?

Below is an example which autoruns in 6.5.0 and 6.5.1 but not in my test environment of 6.3.4:

<form>
  <label>20162411_panel_input_test</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="time">
      <label></label>
      <default>
        <earliest>-60m@m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="dropdown" token="index_tok" searchWhenChanged="false">
      <label>Index:</label>
      <choice value="_*">All</choice>
      <fieldForLabel>index</fieldForLabel>
      <fieldForValue>index</fieldForValue>
      <search>
        <query>| tstats count WHERE index=_* by index</query>
      </search>
      <default>_*</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <input type="dropdown" token="sourcetype_tok" searchWhenChanged="false">
        <label>Sourcetype:</label>
        <choice value="*">All</choice>
        <fieldForLabel>sourcetype</fieldForLabel>
        <fieldForValue>sourcetype</fieldForValue>
        <search>
          <query>| tstats count WHERE index="$index_tok$" by sourcetype</query>
        </search>
        <default>*</default>
      </input>
      <chart>
        <search>
          <query>| tstats prestats=true count WHERE index=$index_tok$ sourcetype=$sourcetype_tok$ by _time sourcetype | timechart count by sourcetype</query>
          <earliest>$earliest$</earliest>
          <latest>$latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">0</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.bubbleMaximumSize">50</option>
        <option name="charting.chart.bubbleMinimumSize">10</option>
        <option name="charting.chart.bubbleSizeBy">area</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.showDataLabels">none</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">default</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.layout.splitSeries.allowIndependentYRanges">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
  </row>
</form>
0 Karma

rjthibod
Champion

Hey Boris, I caught this as well and reported it to Splunk back in of October 2016. It was fixed in Splunk 6.5.2. I don't remember the JIRA ticket number, but I don't think it matters because I am pretty sure it wasn't referenced in the release notes.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...