topic Re: How to exclude results from a saved search in a dashboard using a checkbox? in Dashboards & Visualizations

How to exclude results from a saved search in a dashboard using a checkbox?

snix — Sun, 26 Feb 2017 19:48:00 GMT

I have a saved search that shows IIS logs on a dashboard, it can be a bit verbose depending on the use case. I would like to have an on/off input that would allow the user to filter out some of the non-relevant logs. I figured the checkbox input would make the most sense but I am having issues wrapping my head around how it works and am starting to wander if it is the best option for this solution.

Whatever option I would use would just need to be able to by default filter nothing but if selected add a string into the search for example:

Default off: InputVariable="HTTPStatusCode=*"
Turned on: InputVariable="HTTPStatusCode!=200"
search index=iis $InputVariable$| table field1, field2, field3

Re: How to exclude results from a saved search in a dashboard using a checkbox?

martin_mueller — Sun, 26 Feb 2017 21:10:47 GMT

You could use something like this:

<input type="radio" token="field1">
  <choice value="HTTPStatusCode=*">show</choice>
  <choice value="HTTPStatusCode!=200">hide</choice>
</input>

With a one-option checkbox, the unchecked state would leave the token unset - causing the search to wait for input. A radio input is always set, at least when you define an initial/default value.

Re: How to exclude results from a saved search in a dashboard using a checkbox?

snix — Mon, 27 Feb 2017 01:02:25 GMT

@martin_mueller I tried your suggestion but ran into the issue of unchecking the radio button, it appears to not be an option so I tried the dropdown and got it to work for what I need. Just wish I would have been able to use the checkbox 😞

Re: How to exclude results from a saved search in a dashboard using a checkbox?

martin_mueller — Mon, 27 Feb 2017 08:10:14 GMT

You can't uncheck a radio button, but you can select the second option to unselect the first option.

Re: How to exclude results from a saved search in a dashboard using a checkbox?

snix — Mon, 27 Feb 2017 12:56:54 GMT

I figured as much but for some reason I didn't like the idea of dealing with two inputs when I could set it to deal with only one. So I avoided looking down that path and just trying the dropdown, figured it would then give me room for more filter options in the future if I think of some more.

Re: How to exclude results from a saved search in a dashboard using a checkbox?

snix — Mon, 27 Feb 2017 12:58:49 GMT

I will mark it answered since you did hit on the key issue of the unset token when using the check box make it unusable.

Re: How to exclude results from a saved search in a dashboard using a checkbox?

martin_mueller — Mon, 27 Feb 2017 13:20:27 GMT

That radio input is one input with two options 🙂

Re: How to exclude results from a saved search in a dashboard using a checkbox?

snix — Mon, 27 Feb 2017 13:22:58 GMT

Oh I thought I would need to add a second radio button and tie them together, that makes more sense I will take another look at it then and see what it can do.

Thank You!