Dashboards & Visualizations

Why can't I complete the value of a dropdown input on a form (target) from another form?

altink
Builder

Dear All,

I have a problem when I try to complete the value of a Dropdown input on a form (target) from another form. The Dropdown input in discussion - token="field_scan_id", is a slave (data search populated) to another dropdown - token="field_db_name".

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <unset token="form.field_scan_id"></unset>
      </change>
      <default>*</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

<input type="dropdown" token="field_scan_id" searchWhenChanged="true">
      <label>Scan Id</label>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <search>
        <query>index=omega_ds 
DB_NAME=$field_db_name$  
| DEDUP SCAN_ID 
| FIELDS SCAN_ID</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <default>*</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

I have been forced to unset token "field_scan_id" on every change of "field_db_name" - since the former keeps the old value (wrongly) after dropdown options have been populated differently by the change in database name. However this is not my problem right now.

<change>
        <unset token="form.field_scan_id"></unset>
      </change>

The problem is that when I drill-down from another form to this one, the first input Database is populated correctly, but the second one Scan Id looses value coming from the drill-down URL because of the unset done at master Database Dropdown.

is there something I can do to get the Scan Id value correctly from the drill-down without removing the Unset option ?

thank you very much

best regards,
Altin

0 Karma

rgrewal
New Member

Did you find an answer to this? I am having the same problem.

0 Karma

niketn
Legend

@altink, to me the requirement of field_db_name seems contradicting. Through unset seems like you want to provide the field_scan_id token manually. However, when setting it through external URL, you dont want to manually set field_scan_id.

Also, you have defined default value as asterisk <default>*</default>, however, you have not defined a static choice <choice value="*">All</choice>.

If your concern is that for field_scan_id, invalid value will get selected, then you can actually remove default setting as * and remove unset token code as well. Instead of that use selectFirstChoice which will pick first of the selected values in the dropdown by default:

<selectFirstChoice>true</selectFirstChoice>

Please try out and see if it solves purpose.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

altink
Builder

Hello niketnilay

I have a case in which even usage of select-first-choice does not help.

In the following code below:

<input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <fieldForLabel>DB_NAME</fieldForLabel>
      <fieldForValue>DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ds | DEDUP DB_NAME | FIELDS DB_NAME</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <change>
        <set token="db_name_no_quotes">$value$</set>

      </change>
      <selectFirstChoice>true</selectFirstChoice>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>
    <input type="dropdown" token="field_scan_run_id" searchWhenChanged="true">
      <label>Scan Id Run</label>
      <search>
        <query>index=omega_ds  
DB_NAME=$field_db_name$
| stats 
earliest(_time) as SCAN_DT_START
by DB_NAME SCAN_ID
| sort - SCAN_DT_START</query>
        <earliest>$field1.earliest$</earliest>
        <latest>$field1.latest$</latest>
      </search>
      <fieldForLabel>SCAN_ID</fieldForLabel>
      <fieldForValue>SCAN_ID</fieldForValue>
      <change>
        <set token="scan_run_id_no_quotes">$value$</set>
        <unset token="form.field_scan_bs_id"></unset>
      </change>
      <selectFirstChoice>true</selectFirstChoice>
      <prefix>"</prefix>
      <suffix>"</suffix>
    </input>

drop-down input token "field_scan_run_id" will keep its old selected value even when all is options are changed - because of the change of token="field_db_name" - and the old value is no more.

so using the "selectFirstChoice" (without unset) does not help.

I see in answer 218751 selectfirstchoice-not-working-in-dynamic-dropdowns,
that unset is offered as a solution, but I cannot use it for the URL drill-down failure (scan run id always *)

can you help ?
thanks and regards
Altin

0 Karma

altink
Builder

to further clarify:

If I need two drop-downs and the second slave (in search) to master first, I have to use unset to clear the second's value when first changes - no matter if I use or not select-first-choice in the second.

If I use the unset - things are resolved - old value is cleared.

The problem is:
when I call the form above from a drill-down of another form's dashboard, the first drop-down is correctly set, while the second - being unset-ed by change of the first - looses the value given by the URL.

thanks and regards
Altin

0 Karma

niketn
Legend

@atlink, like you have described your use case for behavior of Master and Slave Drop downs are contradicting. If you want to use both Standalone dashboard with above behavior and drilldown dashboard with both Master and Slave values being set at once, then you would need to use two different dashboards, or else pass the Master value for drilldown with Slave value to be selected in new dashboard which would be consistent with first use case.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

altink
Builder

Hello

I am not sure if we are on the same line.

I am having no drill-down problem here, only that the slave Drop-Down input "field_scan_run_id" keeps its value when the master "field_db_name" has changed.

I know how to fix this by inserting:

<change>
<unset token="form.field_scan_run_id"></unset>
</change>

in the master "field_db_name".
But then this will cause the URL problem - so I am looking to fix this without change/unset

at your disposal for further info
best regards
Altin

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...