Splunk Search

Is it possible for the submit button or checkbox required to act like submit button inside of each panel?

haripriyasarve1
Explorer

Hi all,

I have two panels with input text and drop down boxes in each.
I would like to run my search by using a submit button along with these input boxes inside a panel without using any javascript.
Once I submit the button the values in the table have to be populated in the table in that panel.

1 Solution

vnravikumar
Champion

Hi

Check this

<form>
  <label>panel_example</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="text" token="host" searchWhenChanged="false"></input>
      <input type="checkbox" token="checkbox">
        <label></label>
        <change>
          <condition match="$checkbox$==&quot;submit&quot;">
            <set token="temp">$host$</set>
          </condition>
          <condition>
            <unset token="form.host"></unset>
            <unset token="temp"></unset>
          </condition>
        </change>
        <choice value="submit">Submit</choice>
        <delimiter> </delimiter>
      </input>
      <table depends="$temp$">
        <search>
          <query>index=_internal host=$temp$|stats count by host</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

View solution in original post

0 Karma

niketn
Legend

@haripriyasarvepalli Please find the following run anywhere dashboard which uses Splunk Link List input with CSS override to make is look like a Submit button.

alt text

Following is the approach used. On click of Submit link list using <change> event handler set a dummy token for the search to run. On change of any of the required inputs unset the dummy token for the search query to wait for Submit button click as well.

On completion of the panel search use the <done> search event handler to reset the link list form token for it to be available for Click again.

Please find the complete Simple XML dashboard code with the run anywhere example based on Splunk's _internal index.

<form>
  <label>Submit button without JS</label>
  <fieldset submitButton="false" autoRun="false"></fieldset>
  <row>
    <panel>
      <title>Filter 1</title>
      <input type="time" token="tokTime1" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
        <change>
          <!-- Any input changes reset the Search to wait for Submit button -->
          <unset token="tokSubmit1"></unset>
        </change>
      </input>
      <input type="text" token="tokLogLevel1" searchWhenChanged="true">
        <label>Filter Log Level</label>
        <default>ERROR</default>
        <change>
          <!-- Any input changes reset the Search to wait for Submit button -->
          <unset token="tokSubmit1"></unset>
        </change>
      </input>
      <input id="button_submit1" type="link" token="tokLinkSubmit1" searchWhenChanged="true">
        <label></label>
        <choice value="submit">Submit</choice>
        <change>
          <condition value="submit">
            <!-- Set the token to run the search -->
            <set token="tokSubmit1">true</set>
          </condition>
        </change>
      </input>
      <html depends="$alwaysHideCSSPanel$">
        <style>
          div[id^="button_submit"] div[data-component="splunk-core:/splunkjs/mvc/components/LinkList"]{
            width:40% !important;
          }
          div[id^="button_submit"] button[data-test="option"]{
              padding: 6px 15px;
              font-weight: 500;
              background-color: #5cc05c;
              border: transparent;
          }
          div[id^="button_submit"] span[data-test="label"]{
            color: white !important;
          }
          div[id^="button_submit"] span[data-test="label"]:hover{
              color: #3c444d !important;
          }
        </style>
      </html>
    </panel>
    <panel>
      <title>Filter 2</title>
      <input type="time" token="tokTime2" searchWhenChanged="true">
        <label></label>
        <default>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </default>
        <change>
          <!-- Any input changes reset the Search to wait for Submit button -->
          <unset token="tokSubmit2"></unset>
        </change>
      </input>
      <input type="text" token="tokLogLevel2" searchWhenChanged="true">
        <label>Filter Log Level</label>
        <default>ERROR</default>
        <change>
          <!-- Any input changes reset the Search to wait for Submit button -->
          <unset token="tokSubmit2"></unset>
        </change>
      </input>
      <input id="button_submit2" type="link" token="tokLinkSubmit2" searchWhenChanged="true">
        <label></label>
        <choice value="submit">Submit</choice>
        <change>
          <condition value="submit">
            <!-- Set the token to run the search -->
            <set token="tokSubmit2">true</set>
          </condition>
        </change>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <title>Panel 1</title>
      <chart>
        <search>
          <done>
            <!-- When search completes reset Link List clicked value to allow subsequent click -->
            <unset token="form.tokLinkSubmit1"></unset>
          </done>
<!-- Dummy token dependency added to the search to run only when Submit button is clicked -->
          <query>index=_internal sourcetype=splunkd  log_level="$tokLogLevel1$"
| stats count by component
| fields - "$tokSubmit1$"</query>
          <earliest>$tokTime1.earliest$</earliest>
          <latest>$tokTime1.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.chart">pie</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
    <panel>
      <title>Panel 2</title>
      <chart>
        <search>
          <done>
            <!-- When search completes reset Link List clicked value to allow subsequent click -->
            <unset token="form.tokLinkSubmit2"></unset>
          </done>
<!-- Dummy token dependency added to the search to run only when Submit button is clicked -->
          <query>index=_internal sourcetype=splunkd log_level="$tokLogLevel2$"
| timechart count by component
| fields - "$tokSubmit2$"</query>
          <earliest>$tokTime2.earliest$</earliest>
          <latest>$tokTime2.latest$</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="charting.axisTitleX.visibility">collapsed</option>
        <option name="charting.chart">line</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jviray
Explorer

To get it to work, I had to put log_level="$tokLogLevel2$ in eval.

<query>index=_internal sourcetype=splunkd" log_level="$tokLogLevel1$
| eval log_level="$tokLogLevel1$
| timechart count by component | fields - "$tokSubmit1$"</query>

Also, if someone tries to access a shared dashboard link that somebody worked, the submit button won't work.  In order to fix that, you have to unset $form.tokLinkSubmit1$ under each <change>.

<change>
    <!-- Any input changes reset the Search to wait for Submit button -->
    <unset token="tokSubmit1"></unset>
    <unset token="form.tokLinkSubmit1"></unset>
</change>

 

0 Karma

haripriyasarve1
Explorer

Thank you so much. This is woking fine

0 Karma

vnravikumar
Champion

Hi

Check this

<form>
  <label>panel_example</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="text" token="host" searchWhenChanged="false"></input>
      <input type="checkbox" token="checkbox">
        <label></label>
        <change>
          <condition match="$checkbox$==&quot;submit&quot;">
            <set token="temp">$host$</set>
          </condition>
          <condition>
            <unset token="form.host"></unset>
            <unset token="temp"></unset>
          </condition>
        </change>
        <choice value="submit">Submit</choice>
        <delimiter> </delimiter>
      </input>
      <table depends="$temp$">
        <search>
          <query>index=_internal host=$temp$|stats count by host</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

haripriyasarve1
Explorer

Thank you so much. It was helpful

0 Karma

Sukisen1981
Champion

you cant have a submit button inside a panel without JS, but you can go for check box in each of the panels.
You can namethe check box as something like 'select box for results', and you can validate in the search SPL of the check box if users have given proper inputs in the dropdown and input text

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...