Splunk Search

Is it possible to put a Checkbox (YES/NO) in order to let the user choose whether or not to apply drop-down input choices (addinput)?

skender27
Contributor

Hi,

I have an addinput drop-down selection which applies to my dashboard (as a token).
Is it possible to put a Checkbox (YES/NO) in order to let the user choose whether or not to apply the drop-down choices?
In the sense that if you choose NO, the choices of the drop-down menu are useless and do not apply to the search string...

Thanks,
Skender

0 Karma

somesoni2
Revered Legend

It depends on how your dropdown selection is used in panel searches. You can have a checkbox with a default value and panel search will have a subsearch to apply dropdown filter based on checkbox value.

A run anywhere sample dashboard is here.

<form>
  <label>ConditionalFilter</label>
  <fieldset submitButton="false">
    <input type="checkbox" searchWhenChanged="true" token="applyFilter">
      <label></label>
      <choice value="1">Apply Filter</choice>
      <default>0</default>
    </input>
    <input type="dropdown" searchWhenChanged="true" token="sourcetype">
      <label>Select Sourcetype</label>
      <choice value="splunkd">splunkd</choice>
      <choice value="scheduler">scheduler</choice>
      <choice value="splunkd_ui_access">splunkd_ui_access</choice>
      <default>splunkd</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal [| gentimes start=-1 | eval sourcetype=if(replace("$applyFilter$",".*(\d)","\1")="1","$sourcetype$","*") | table sourcetype]| timechart  count by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>        
      </chart>
    </panel>
  </row>
</form>

skender27
Contributor

Hi,

It is exactly what i need.
The dropdown uses a token field and has some static options selections key=value and by default I need it to be appliable (YES check).
If I select the NO checkbox, the dropdown selections (so the token field) ahs no effect at all to the search string.

Should I do this by modifying the xml or by web interface?

Thanks,
Skender

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...