All Apps and Add-ons

Unable to set autoRun on nested search

sbsbb
Builder

I have :
URLloader
Search autoRun=true
Pulldown
Pulldown
Pulldown
Button
Search

  • the first search is populating the pulldown with a |metadata search
  • the second one is supposed to launch a real search, but I want the user beeing able to choose the pulldown before (so I can't have a bette search, only based on some sources)

But in the Sideview editor, I can't unset autoRun=true on elements after the first search. And in the code, even if autorun=true is not set, the second search is also runing automatically...

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

What you want to do, is leave the autoRun the way it is and set the allowAutoSubmit param to True on the Button module. That will get you what you want. The autoRun=True is actually necessary to populate those Pulldowns when the page loads. But the allowAutoSubmit param set to False will make the Button module stop the downstream search(es) from dispatching.

Also there is no such thing as autoRun="False". Sometimes you see people put autoRun="False" into views but trust me - it has no effect at all besides to confuse people.

Also, it's a best practice to pull up the autoRun="True" attribute up to the highest level - in this case I would set it on the URLLoader module and not on that Search module. This is just a good habit to get into, to minimize the chances of ever nesting an autoRun="True" inside another one. Because the highest module in a dashboard is often a Search or HiddenSearch module, and because the highest module is the one that usually has the autoRun="True", there is a widespread misconception that autoRun is a param on those modules specifically, but it is not. Instead autoRun is a generic attribute that you can put on any module that says "start the ball rolling from this point and dispatch any searches that you find downstream from here."

For a good explanation of this and more, and of how the Advanced XML works, download a recent copy of the Sideview Utils app and in the embedded Sideview docs read "Key Techniques > Overview of the Advanced XML"

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

What you want to do, is leave the autoRun the way it is and set the allowAutoSubmit param to True on the Button module. That will get you what you want. The autoRun=True is actually necessary to populate those Pulldowns when the page loads. But the allowAutoSubmit param set to False will make the Button module stop the downstream search(es) from dispatching.

Also there is no such thing as autoRun="False". Sometimes you see people put autoRun="False" into views but trust me - it has no effect at all besides to confuse people.

Also, it's a best practice to pull up the autoRun="True" attribute up to the highest level - in this case I would set it on the URLLoader module and not on that Search module. This is just a good habit to get into, to minimize the chances of ever nesting an autoRun="True" inside another one. Because the highest module in a dashboard is often a Search or HiddenSearch module, and because the highest module is the one that usually has the autoRun="True", there is a widespread misconception that autoRun is a param on those modules specifically, but it is not. Instead autoRun is a generic attribute that you can put on any module that says "start the ball rolling from this point and dispatch any searches that you find downstream from here."

For a good explanation of this and more, and of how the Advanced XML works, download a recent copy of the Sideview Utils app and in the embedded Sideview docs read "Key Techniques > Overview of the Advanced XML"

0 Karma

sbsbb
Builder

Ok in fact what I was searching for is
allowAutoSubmit=false

It works ! I've really missunderstood autoRun, thanks for the explanations

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...