All Apps and Add-ons

Prevent autorun of an upstream base search when setting filters for downstream postprocess

chrisX
Engager

Dear Splunk Community,

I have a dashboard with a base search that aggregates data and takes a bit to run. "Underneath" it are supposed to be a few pulldown modules to filter the following postprocesses.
I would like the base search only to run when the dashboard is loaded, but not to rerun when the downstream pulldown values are selected.
Here only the postprocesses should rerun/autorun.

Any advice on how to achieve that or how to explain my problem more clearly is greatly appreciated.

Thanks in advance,

C

Here my simplified samplecode:

<module name="Search" autoRun="True">
 <param name="search"> my Base Search
 </param>

 <module name="Pulldown">
  <param name="label">PulldownFilter</param>
  <param name="name">Filter</param>

  <module name="PostProcess" autoRun="True">
   <param name="search"> my PostProcessSearch $Filter$
   </param>

   <module name="HiddenChartFormatter"> ...

    <module name="FlashChart"...
    </module>
   </module>
  </module>
 </module>
</module>   

sideview
SplunkTrust
SplunkTrust

I would use a Button module, and set these params on that Button moduile.

 <param name="allowAutoSubmit">True</param>
 <param name="allowSoftSubmit">False</param>

The first one only affects the module at page-load time, and tells the Button to let a push through if the page is loading. The second param only takes affect after page-load-time and tells the module that if a push comes down, do not let it through. The user will then have to click the green button in order to push downstream from the button.

0 Karma

chrisX
Engager

Thanks for your input. Below or above which module would you put the button? Plus I seem to have mixed up what downstream/upstream means...??? My intention is that the child modules (downstream?) of my filters rerun automatically but the parent base search (upstream?) does not. Your answer sounds like the user has to press the button to reload the (downstream?) postprocesses or am I missing something? Thanks

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...