All Apps and Add-ons

SavedSearch Module - Have useHistory param take in a $foo$ token

cmak
Contributor

I am using a checkbox module that passes down either "True" or "False".
In my SavedSearches module, I have the usehistory param being $foo$, from the above checkbox.
I would like the user to be able to check the box so that the search is run, instead of taking the results from history.
However, the $foo$ token in useHistory param value is not being registered (it seems to be always set as True)

is there a way to do this?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

View solution in original post

sideview
SplunkTrust
SplunkTrust

I'm afraid the useHistory param does not accept $foo$ substitution at the moment. The work that has to be done if useHistory is set to True, all has to be done before the page loads, so this was never really in the running for being a dynamic key at runtime. However I'll consider it - I could rewrite the module so that it always does the work of figuring out the most recent job, that way it could in theory make the switch at runtime and on demand.

But to back up for a moment, the only allowed values of useHistory are "True", "False" and "Auto", so I'm afraid if you're setting it to anything else except those three values, then you should be getting an error message to that effect.

Furthermore, if you're not seeing that error message in your view, check to make sure you have at least one Message module with a "*" filter - if you don't have at least one Message module to be a catchall for all error messaging, you can lose a great deal of time banging your head into things wondering why they aren't working.

sideview
SplunkTrust
SplunkTrust

Ah. Interesting. There's a bug in Splunk. If the module param is not "required", then SplunkWeb will basically ignore the "values" param and let the author set any value they feel like. I never noticed that. (line 304 of $SPLUNK_HOME/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/memoizedviews.py). The mistake appears to go back at least as far as 4.3. I'll report it to Splunk Support.

0 Karma

cmak
Contributor

Thanks for letting me know about the saved search issue.

By the way, I do have the message module, but am not seeing errors. I have noticed this for the past little while.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...