Knowledge Management

How to clear dependent value when start new search

simmppllee
New Member

Hi guys,
please help me,
I have 2 tables, one of them is hidden and shows contents when I click on parameter "time" in another table. It's means that second table has dependent from another, how it's look like in simple xml -
But there is one problem. When I have passed the value to the parameter $Time$ at once it's stored for all time, I means that if I change all my inputs for dashboard and click submit button, first table will change, but second table will not be hidden and will not be change because it will store parameter from the previous one search's.

So how can I clean parameter $Time$ when I click submit button or another way.

P.S. I can clean $Time$ if I refresh all page via browser.

Tags (1)
0 Karma

niketn
Legend

@simmppllee, your intent in to clear the tokens on click of Submit button. You can leverage Simple XML JS Extension for this scenario.

As per your description Time token/s is/are being selected based on the row clicked in table 1 and then passed on to the table 2. You want to reset the time token/s on click of Submit button.

Step 1: Assuming your time tokens are $EarliestTime$ and $LatestTime$ set in Simple XML from table 1. Save the following JavaScript file unset_token_on_submit.js under the static folder of your Splunk App (for example: $SPLUNK_HOME\etc\app\<YourAppName>\appserver\static)

require([
    "splunkjs/mvc",
    "jquery",
    "splunkjs/mvc/simplexml/eventhandler"
    ],
    function(
        mvc,
        $,      
        EventHandler
        ) {
        //jQuery to capture Submit button click event   
        $('#submit').on("click", function() {
            //Use EventHandler utiliy to unsetTokens
            EventHandler.unsetToken("EarliestTime");
            EventHandler.unsetToken("LatestTime");
        });
    }
);

Step 2: Include the script file in your form

<form script="unset_token_on_submit.js">

Step 3: Bump splunk (restart/refresh Splunk instance) and clear internet browser history for changes to reflect.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

simmppllee
New Member

Thanks for your answer.

0 Karma

niketn
Legend

@simmppllee, if you have tried this and it worked for you please accept the answer.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@simmppllee, can you mark this as answered if your issue is resolved?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

Create an init section and then unset your dependent token from it. You can find examples like this and many other tricky/clever things by going through the "Splunk 6.x Dashboard Examples" app:
https://splunkbase.splunk.com/app/1603/

0 Karma

simmppllee
New Member

Can you say me where I can find section which can help me in "Splunk 6.x Dashboard Examples".
I have seen "Token Customization", but here aren't any solution for my task.
Thanks.

0 Karma

simmppllee
New Member

init section can't be created inside panel, so I can't reset token.
I have created init section and unset token in section, but it hasn't helped

0 Karma

woodcock
Esteemed Legend

Create a done section in the first panel and unset the token there, too. That way when you select different field values and the first panel re-runs, it will unset the token.

0 Karma

simmppllee
New Member

Thanks, your answer has helped.

0 Karma

woodcock
Esteemed Legend

So do you have it? If so, come back and click Answer somewhere and UpVote any comments that helped.

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...