Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I update a dropdown token (and all associated nested tokens) upon pressing the submit button?

$
0
0
Hi, I am trying to perform a search in 3 different ways using a dropdown. Depending on which search criteria is selected, tokens from the relevant search inputs are all passed into the dropdown token ($multisearch$) which is then passed into the relevant panels to display the search result in table and raw event format. When I click the submit button after entering new text into a relevant search text field, the search does not update. I have narrowed this problem down to one of my tokens not updating (the $multisearch$ token from the "Search Criteria" dropdown). There is one quirk I found that makes the search update in the panels (for the default option only) but it is not a solution to my problem, when I click submit after changing my search and then click on the clear button (x) in the dropdown the search updates in all the panels. I think the reason for this is that the token is re-evaluated once the value is reset. Is there a way to force the dropdown token to re-evaluate every time one of the associated inputs is changed? Setting "Search on Change" to true for relevant inputs has no effect. I have trimmed my dashboard Source code as follows:
[^,]+),(?.+)?$" | eval firstname=if(firstname=="",realname,firstname) | eval name= firstname . " " . lastname | fields name ]]>$result.name$Dashboard
Welcome, $username$!HomeReset DashboardAll123**-60m@mnowSimple SearchSpecific SearchMultiple Searchsimple$searchString0$1$searchString1$1$searchString1$ $logic1$ $searchString2$11simple*"**"BANCACserviceIDusername*$radioSearchFilter1$"**"ORANDORORBANCACserviceIDusernameBAN=BAN=*$radioSearchFilter2$"**"
Tableindex="" source="" | eval RawTime=_time | convert ctime(_time) AS TimeStamp | search Environment="$Env$" $multisearch$ | sort _time desc$field1.earliest$$field1.latest$1$row.BAN$$row.CAC$$row.TimeStamp$$row.source$$row.Environment$$row._time$$row.RawTime$
Drilldownindex="" source="" | eval RawTime=_time | search Environment="$Env$" $multisearch$ | sort TimeStamp desc$field1.earliest$$field1.latest$
Raw Eventsindex="" source="" | eval RawTime=_time | search Environment="$Env$" $multisearch$ | sort _time desc$field1.earliest$$field1.latest$
Thank you for your time.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>