Dashboards & Visualizations

Why is the base search not running at loading time and the optional filter input is not being displayed?

manur
Explorer

We have a dashboard with filters in a <fieldset> configured with autoRun=false, along with a submit button.

Some filters should only be displayed when the current user has a specific role. To find this, I run a base search calling the REST api and I set a token if the user has the role. This token is then used in the depends attribute of the <input>.

My problem is that the first time the dashboard is loaded, the base search is apparently not run and thus the optional filter input is not displayed (although the current user has the needed role). One needs to submit the filters at least once to see the optional filter appear.
How can I overcome this ?

Note : I don't want to use rejects instead of depends as the reverse problem will happen : users without the specific role will see the optional filter until they submit the search.

Here's a code with "power" used as the "trigger" role. The user you're using should inherit the power role in order to reproduce the problem :

<form hideFooter="true">
  <label>Splunk Test</label>
  <description>Splunk Test</description>

    <search id="detectPower">
     <query>| rest splunk_server=local /services/authentication/current-context | table roles 
            | search roles="power"
     </query>
     <done>
       <condition match="$job.resultCount$ > 0">
         <set token="powerUser">true</set>
       </condition>
       <condition>
         <unset token="powerUser"></unset>
       </condition>       
     </done>
   </search>  

  <fieldset submitButton="true" autoRun="false">
    <input type="time" token="tokenTime" searchWhenChanged="false">
      <label>Time</label>
      <default>
        <earliest>@d</earliest>
        <latest>now</latest>
      </default>
    </input>

    <!-- Only for power users -->
    <input type="dropdown" token="tokenComponent" searchWhenChanged="false" depends="$powerUser$">
      <label>Component</label>
      <choice value="*">All components</choice>
      <search>
        <query>index=_internal | fields component | dedup component | sort component</query>
      </search>
      <fieldForLabel>component</fieldForLabel>
      <fieldForValue>component</fieldForValue>
      <default>*</default>
    </input>
  </fieldset>

  <row>
    <panel>
      <html><p>powerUser: $powerUser$</p></html>
      <table>
        <search>
          <query>index=_internal component=$tokenComponent$
                 | stats count by log_level</query>
          <earliest>$tokenTime.earliest$</earliest>
          <latest>$tokenTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

We're using Splunk 6.5.5.

0 Karma

efavreau
Motivator

@manur  I know this is an old question, but in case people come across this, here's a potential answer:

After the basesearch's </query> tag, try adding

        <earliest>-1d@d</earliest>
        <latest>now</latest>

Giving props where props are due:
https://community.splunk.com/t5/Dashboards-Visualizations/Using-base-search-in-drop-down-list/m-p/50...

###

If this reply helps you, an upvote would be appreciated.
0 Karma

manur
Explorer

One possible solution I have found is to enable searchWhenChanged="true" on one of the inputs.

At loading of this page, the data will be fetched and the base search will be run.

This contradicts a bit my requirements, though (data fetching only when the user clicks the submit button).

Is there another solution ? Couldn't some JavaScript force the launch of the base search at loading time instead ?

0 Karma

maciep
Champion

seems to work on my free 7.0.1 license...had to change the role search to admin since there are no users in the free version, but the input displayed as expected. And when i changed the role search to something else, the dropdown didn't display.

0 Karma

manur
Explorer

@maciep: I've just tried with a docker image of Splunk 7.0.2 and I kept having the same problem.
I created a user with only the "power" role, I opened the dashboard, I couldn't see the "Component" dropdown.
I clicked on Submit, the dropdown appeared.

0 Karma

maciep
Champion

ok, maybe i didn't test it fully enough. I don't think i ever left the dashboard and came back to it...just updated the xml, saved and refreshed.

I do see similar behavior on 6.5.2 as well

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...