topic Re: Checkbox and dropdown in Dashboards & Visualizations

Checkbox and dropdown

sreelesh_n — Thu, 31 Dec 2015 05:34:40 GMT

below is my dashboard code, when checkbox is selected i want splunkd* only to be shown in the dropdown else all.
below code seems like is finding checkbox is selected and going to if section , but,sourcetype like "splunkd*" is always evaluating to true/false and also like doesnt seems to work ? any updates?

    <query>index=_internal | eval field1=    if(replace("$applyFilter$",".*(\d)","\1")="1",sourcetype like  "splunkd*", ,sourcetype)</query>

--Sree

<form>
  <label>ConditionalFilter1</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="applyFilter" searchWhenChanged="true">
      <label></label>
      <choice value="1">Apply Filter</choice>
      <default>0</default>
    </input>
    <inpu't type="dropdown" token="field1" searchWhenChanged="true">'
      <search>
        <query>index=_internal | eval field1=    if(replace("$applyFilter$",".*(\d)","\1")="1",sourcetype,sourcetype)</query>
      </search>
      <fieldForLabel>field1</fieldForLabel>
      <fieldForValue>field1</fieldForValue>
    </input>
  </fieldset>
</form>

Re: Checkbox and dropdown

sundareshr — Thu, 31 Dec 2015 06:32:14 GMT

I am not sure I understand your question or what it is that you are trying to do. You dashboard has no controls, not sure it will render anything. Can you explain what is the dashboard supposed to do?

Does this give you what you are looking for?

ConditionalFilter1

<input type="radio" token="field1" searchWhenChanged="true">
  <choice value="splunkd">splunkd</choice>
  <choice value="*">all</choice>
  <default>*</default>
  <initialValue>*</initialValue>
</input>
<input type="dropdown" token="field2" searchWhenChanged="true">
  <search>
    <query>index=_internal sourcetype=$field1$  | dedup sourcetype</query>
    <earliest>@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
</input>

Re: Checkbox and dropdown

sreelesh_n — Thu, 31 Dec 2015 11:05:37 GMT

hi,

sourcetype has dynamic list of values ("splunkd1" , "splunkd2", "appd" , "splunktest") . if checkfox is selected i need only splunkd1 ,splunkd2 ones to be shown in drop down , else all the 4 .

fyi - drop down is a search criteria for me -i have a chart to show based on what i select from above dropdown.

Re: Checkbox and dropdown

sundareshr — Thu, 31 Dec 2015 16:28:07 GMT

Give this a shot. Set the default and initial values to "" for "un-selected" state & to "splunk" for selected state. In your search query for the dropdown, set sourcetype=$field1*

ConditionalFilter1

<input type="checkbox" token="field1" searchWhenChanged="true">
  <choice value="splunkd">splunkd</choice>
  <default></default>
  <initialValue></initialValue>
</input>
<input type="dropdown" token="field2" searchWhenChanged="true">
  <search>
    <query>index=_internal sourcetype=$field1$*  | dedup sourcetype</query>
    <earliest>@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
</input>


<panel>
  <event>
    <title>User selections - radio: $field1$; dropdown: $field2$</title>
    <search>
      <query>index=_internal sourcetype=$field2$</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
  </event>
</panel>

Re: Checkbox and dropdown

sreelesh_n — Mon, 04 Jan 2016 01:17:15 GMT

thanks,it what I needed.

but i also need to do for not equals, any advise? i tried below but it's not working
index=_internal | search NOT sourcetype = $field1$* | dedup sourcetype

if field = splunkd (ie selected) , then excluding splunkd* should be shown
else all should be shown

Re: Checkbox and dropdown

sundareshr — Mon, 04 Jan 2016 03:25:56 GMT

Here's one way. Set the "value" for selected checkbox to !=splunkd and add a prefix of "sourcetype" and default value of ""

<form>
  <label>ConditionalFilter1</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="checkbox" token="field1" searchWhenChanged="true">
      <choice value="!=splunkd">splunkd</choice>
      <prefix>sourcetype</prefix>
      <default></default>
    </input>
    <input type="dropdown" token="field2" searchWhenChanged="true">
      <search>
        <query>index=_internal $field1$*  | dedup sourcetype</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>User selections - radio: $field1$; dropdown: $field2$</title>
        <search>
          <query>index=_internal sourcetype=$field2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

Re: Checkbox and dropdown

sreelesh_n — Mon, 04 Jan 2016 04:57:10 GMT

thank you , this is what i was looking for ,btw i have added this to my actual code and there it 's not working
i am applying this for my interested field ProcessContext_ProjectName
but it gives an error " it could not create a search -syntax error as left hand of != doesnt have invalid term on left side "
pls note that i have used a search query to filter out field
Thanks,

TSNew

<input type="dropdown" token="ProcessContext_ProjectName" searchWhenChanged="true">
  <search>
    <query>index=u2 sourcetype=jms_body_header_txt | fields ProcessContext_ProjectName 
      | search  ProcessContext_ProjectName =  $field1$*   | dedup ProcessContext_ProjectName           
     | table ProcessContext_ProjectName</query>
  </search>
  <fieldForLabel>ProcessContext_ProjectName</fieldForLabel>
  <fieldForValue>ProcessContext_ProjectName</fieldForValue>
</input>
 <input type="checkbox" token="field1" searchWhenChanged="true">
   <choice value="!=JMSAdapter">JMSAdapter</choice>
   <prefix>ProcessContext_ProjectName</prefix>
   <default></default>
 </input>

Re: Checkbox and dropdown

sreelesh_n — Mon, 04 Jan 2016 15:56:08 GMT

this is working fine , but with search options seems like it's not . I need to do on a particular field , but it gives an error Error msg is != have an invalid symbol at the left side

    <query>index=u2 sourcetype=jms_body_header_txt | fields ProcessContext_ProjectName 
      | search  ProcessContext_ProjectName =  $field1$*   | dedup ProcessContext_ProjectName           
     | table ProcessContext_ProjectName</query>
  </search>