Hi All,
Not Sure why this has been running in Splunk 6 like this. I have a form with a timepicker and search button. As soon i open the form the search underlying it is being auto runned. tried setting the attribute autoRun="False" but that doesnt solve my purpose .
It works well in Splunk 5 versions but not on 6 . Is this expected behaviour ?? how can i handle this ?? i dnt want the form to auto load without an user intervention.
My Form Code ::
<form >
<label>Sample form</label>
<fieldset autoRun="false" submitButton="true">
<input type="time">
<default>Last 60 minutes</default>
</input>
</fieldset>
<row>
<chart>
<searchString >index=_internal |stats count by host</searchString>
<title>Sample Test</title>
<option name="charting.chart">pie</option>
<option name="charting.chart.nullValueMode">gaps</option>
<option name="charting.chart.stackMode">stacked</option>
<option name="charting.drilldown">all</option>
<option name="charting.layout.splitSeries">false</option>
<option name="charting.legend.labelStyle.overflowMode">ellipsisNone</option>
<option name="charting.legend.placement">right</option>
<option name="height">200px</option>
<option name="charting.data.count">0</option>
<option name="charting.chart.sliceCollapsingThreshold">0</option>
<option name="charting.chart.showPercent">true</option>
</chart>
</row>
</form>
Thanks
You can force the search to rely on the form without changing the search results like this:
<form>
<fieldset autoRun="false" submitButton="true">
<input type="time">
<default>Last 60 minutes</default>
</input>
</fieldset>
<row>
<table>
<searchString >index=_internal | rename comment as "$earliest$" | stats count by host</searchString>
<earliest>$earliest$</earliest>
<latest>$latest$</latest>
</table>
</row>
</form>
The reference to a token in the rename causes the search to wait for the form to be submitted, while the rename itself does not affect search performance or search results.
Worked for me. But why did I need this on a form that behaved just fine on splunk 5.0.4?
yes..i am not relying on any tokens ..but then i dont want the search to run on the form load.. i need the search to run only on user intervention.....how can i acheive this ??
That may be related to your search not relying on any tokens from the form.