Hi,
I am trying to perform a search in 3 different ways using a dropdown.
Depending on which search criteria is selected, tokens from the relevant search inputs are all passed into the dropdown token ($multisearch$) which is then passed into the relevant panels to display the search result in table and raw event format.
When I click the submit button after entering new text into a relevant search text field, the search does not update.
I have narrowed this problem down to one of my tokens not updating (the $multisearch$ token from the "Search Criteria" dropdown).
There is one quirk I found that makes the search update in the panels (for the default option only) but it is not a solution to my problem. After changing my search, when I click submit and then click on the clear button (x) in the dropdown, the search updates in all the panels.
I think the reason for this is that the token is re-evaluated once the value is reset.
Is there a way to force the dropdown token to re-evaluate every time one of the associated inputs is changed?
Setting "Search on Change" to true for relevant inputs has no effect.
I have trimmed my dashboard Source code as follows:
<form>
<search id="base_name">
<query>
<![CDATA[
| rest /services/authentication/current-context splunk_server=local | eval firstname="" | eval lastname="" | rex field=realname "^(?<lastname>[^,]+),(?<firstname>.+)?$" | eval firstname=if(firstname=="",realname,firstname) | eval name= firstname . " " . lastname | fields name
]]>
</query>
<done>
<set token="username">$result.name$</set>
</done>
</search>
<label>Foo</label>
<description>Dashboard</description>
<fieldset submitButton="true" autoRun="false"></fieldset>
<row depends="$alwaysHideCSSPanel$">
<panel>
<html/>
</panel>
</row>
<row>
<panel>
<title>Welcome, $username$!</title>
<html>
<!-- Home Menu Button -->
<a href="Enter Your Own" class="home_btn">Home</a>
<!-- Reset Button -->
<a href="Link to page" class="reset_btn">Reset Dashboard</a>
<style>
.reset_btn{
border-radius: 5px;
font-size: 12px;
color: black;
font-weight: bold;
padding: 6px 8px 6px 8px;
margin: 5px;
border-top: 1px solid #CCCCCC;
border-right: 1px solid #333333;
border-bottom: 1px solid #333333;
border-left: 1px solid #CCCCCC;
display:inline-block;
}
.home_btn{
border-radius: 5px;
font-size: 12px;
color: black;
font-weight: bold;
padding: 6px 8px 6px 8px;
border-top: 1px solid #CCCCCC;
border-right: 1px solid #333333;
border-bottom: 1px solid #333333;
border-left: 1px solid #CCCCCC;
display:inline-block;
}
.reset_btn:hover {
background-color: #000;
}
.home_btn:hover {
background-color: #000;
}
/* Style the tab content */
.tabcontent {
color: white;
display: none;
padding: 5px;
text-align: center;
background-color:green;
}
.dashboard-title{ color:#FFFFFF }
.icon-inline{text-align:center!important;}
.system-icon{width: 55px;}
.panel-title{font-size: 30px!important;}
</style>
</html>
<html>
</html>
</panel>
</row>
<row>
<panel>
<input type="dropdown" token="Env" searchWhenChanged="false">
<label>Environment</label>
<choice value="*">All</choice>
<choice value="1">1</choice>
<choice value="2">2</choice>
<choice value="3">3</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="field1" searchWhenChanged="false">
<label>TimePicker</label>
<default>
<earliest>-60m@m</earliest>
<latest>now</latest>
</default>
</input>
<input type="dropdown" token="multisearch" searchWhenChanged="false">
<label>Search Criteria</label>
<choice value="simple">Simple Search</choice>
<choice value="specific">Specific Search</choice>
<choice value="multiple">Multiple Search</choice>
<default>simple</default>
<change>
<condition value="simple">
<set token="multisearch">$searchString0$</set>
<set token="showSearch0">1</set>
<unset token="showSearch1"></unset>
<unset token="showSearch2"></unset>
</condition>
<condition value="specific">
<set token="multisearch">$searchString1$</set>
<set token="showSearch1">1</set>
<unset token="showSearch2"></unset>
<unset token="showSearch0"></unset>
</condition>
<condition value="multiple">
<set token="multisearch">$searchString1$ $logic1$ $searchString2$</set>
<unset token="showSearch0"></unset>
<set token="showSearch1">1</set>
<set token="showSearch2">1</set>
</condition>
</change>
<initialValue>simple</initialValue>
</input>
<input type="text" token="searchString0" searchWhenChanged="false" depends="$showSearch0$">
<label>Simple Search</label>
<default>*</default>
<prefix>"*</prefix>
<suffix>*"</suffix>
</input>
<input type="radio" token="radioSearchFilter1" searchWhenChanged="false" depends="$showSearch1$">
<label>Select Keyword 1</label>
<choice value="BAN=">BAN</choice>
<choice value="CAC=">CAC</choice>
<choice value="serviceID=">serviceID</choice>
<choice value="username=">username</choice>
</input>
<input type="text" token="searchString1" searchWhenChanged="false" depends="$showSearch1$">
<label>Search 1</label>
<default>*</default>
<prefix>$radioSearchFilter1$"*</prefix>
<suffix>*"</suffix>
</input>
<input type="dropdown" token="logic1" searchWhenChanged="false" depends="$showSearch2$">
<label>Filter Logic</label>
<choice value="OR">OR</choice>
<choice value="AND">AND</choice>
<default>OR</default>
<initialValue>OR</initialValue>
</input>
<input type="radio" token="radioSearchFilter2" searchWhenChanged="false" depends="$showSearch2$">
<label>Select Keyword 2</label>
<choice value="BAN=">BAN</choice>
<choice value="CAC=">CAC</choice>
<choice value="serviceID=">serviceID</choice>
<choice value="username=">username</choice>
<default>BAN=</default>
<initialValue>BAN=</initialValue>
</input>
<input type="text" token="searchString2" searchWhenChanged="false" depends="$showSearch2$">
<label>Search 2</label>
<default>*</default>
<prefix>$radioSearchFilter2$"*</prefix>
<suffix>*"</suffix>
</input>
<html>
<div>
<style>
#submit {
position: relative;
top: 275px;
z-index: 1;
float: right;
margin: 5px;
}
</style>
</div>
</html>
</panel>
</row>
<row>
<panel>
<table>
<title>Table</title>
<search>
<query>index="" source=""
| eval RawTime=_time
| convert ctime(_time) AS TimeStamp
| search Environment="$Env$" $multisearch$
| sort _time desc</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">10</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">cell</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<drilldown>
<set token="SF_BAN">$row.BAN$</set>
<set token="SF_CAC">$row.CAC$</set>
<set token="SF_TimeStamp">$row.TimeStamp$</set>
<set token="SF_Source">$row.source$</set>
<set token="SF_Environment">$row.Environment$</set>
<set token="SF_time">$row._time$</set>
<set token="SF_RawTime">$row.RawTime$</set>
</drilldown>
</table>
</panel>
<panel>
<event>
<title>Drilldown</title>
<search>
<query>index="" source=""
| eval RawTime=_time
| search Environment="$Env$" $multisearch$
| sort TimeStamp desc</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
<row>
<panel>
<event>
<title>Raw Events</title>
<search>
<query>index="" source=""
| eval RawTime=_time
| search Environment="$Env$" $multisearch$
| sort _time desc</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
<option name="list.drilldown">none</option>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
</form>
Thank you for your time.
... View more