topic Re: Search a yes/no field with a single checkbox token in Dashboards & Visualizations

Search a yes/no field with a single checkbox token

altink — Mon, 24 Sep 2018 19:29:20 GMT

Dear All,

I have a YES/NO field named "FIELD2" which I want to search with a single checkbox token named "Checkbox1" , in the following way:

Checkbox1.checked = TRUE   
search:  index=db FIELD1= FIELD2="YES"

Checkbox2.checked = FALSE  
search:  index=db FIELD1= FIELD2="*"
or better
search:  index=db FIELD1=

I tried with condition and match but no result.

Can someone advise "from scratch"?

best regards
Altin

Re: Search a yes/no field with a single checkbox token

Vijeta — Mon, 24 Sep 2018 20:09:22 GMT

Hi,
Try with these conditions for checkbox,

YES
NO

Also in your search use FIELD=$checkbox_tokenname$

Re: Search a yes/no field with a single checkbox token

altink — Mon, 24 Sep 2018 20:33:29 GMT

Thank you very much for the reply.

to explain better,
below is the code of my checkbox:

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
      <label>toggle</label>
      <choice value="YES">On</choice>
      <change>
        <condition match="$checkbox1$==&quot;YES&quot;">
          <set token="token2">"YES"</set>
        </condition>
        <condition>
          <set token="token2">"*"</set>
        </condition>
      </change>
    </input>

and the search is like

index=.... FIELD2= $token2$

Initially when it opens, the search is made with FIELD2= "*".
When I first check the checkbox - id does not search. Or better said - it is searching the same (all), thus no movement in the page.
Checking and unchecking later will work - but in the opposite expected result.
When Checked - all results YES/NO come out - I was expecting only YES.
When unchecking - only the YES come out - I was expecting both.

best regards
Altin

Re: Search a yes/no field with a single checkbox token

Vijeta — Tue, 25 Sep 2018 06:00:00 GMT

Instead of using condition tags, you can use below if it helps

and the token for checkbox i.e. checkbox1 can be used in search like
index=.... FIELD2= "$checkbox1$"

Please check if it needs to be in quotes or not, see the value of checkbox token in URL when dashboard loads.

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 09:36:19 GMT

I have tried that (using the same chekbox-es token), but it doesn't work.

regards
Altin

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 11:45:07 GMT

I have done what I need with a Dropdown as below:

<input type="dropdown" token="field2">
      <label>Effective User</label>
      <default>*</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
      <choice value="YES">On</choice>
      <choice value="*">Off</choice>
    </input>

and the search is:

... | search ......... CURR_USER=$field2$

What I need is to to the same, but with a Checkbox, not a Dropdown

best regards
Altin

Re: Search a yes/no field with a single checkbox token

Vijeta — Tue, 25 Sep 2018 16:49:33 GMT

Hi,

I was able to do with the checkbox, similar code to what you have done. See the code below, it works fine for me.

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
  <label></label>
  <choice value="YES">On</choice>
  <change>
    <condition match="$checkbox1$==&quot;YES&quot;">
      <eval token="token2">"YES"</eval>
      <!--<unset token="checkbox1"></unset>-->
    </condition>
    <condition>
      <eval token="token2">"*"</eval>
    </condition>
  </change>
  <delimiter> </delimiter>
  <default>YES</default>
  <initialValue>YES</initialValue>
</input>

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 18:15:49 GMT

It works in the opposite, not the way I am looking for.
Checked - shows All
Unchecked - shows only YES

best regards
Altin

Re: Search a yes/no field with a single checkbox token

Vijeta — Tue, 25 Sep 2018 18:36:34 GMT

Hi,
This is happening only when dashboard is initially loaded, once you click on the checkbox the token sets appropriately.
I removed the default and initiaValue options for my checkbox, and now on refreshing the dashboard the initial value of checkbox is unchecked and token value is *, on checking the box the token value is changing to Yes and again on unchecking to * which is as expected.
It works perfect for me.

Thanks
Vijeta

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 18:44:30 GMT

thank you very much for following this.

but I have the same result (opposite behavior), even after removing lines as suggested

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
   <label></label>
   <choice value="YES">On</choice>
   <change>
     <condition match="$checkbox1$==&quot;YES&quot;">
       <eval token="token2">"YES"</eval>
       <!--<unset token="checkbox1"></unset>-->
     </condition>
     <condition>
       <eval token="token2">"*"</eval>
     </condition>
   </change>
   <delimiter> </delimiter>
 </input>

best regards
Altin

Re: Search a yes/no field with a single checkbox token

Vijeta — Tue, 25 Sep 2018 18:49:48 GMT

How are you checking the value of token2? It would be good if you can diaplay token2 value on the panel and verify the behavior of tokens.

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 19:38:47 GMT

I open the search loop button and see the whole search in a new Search form. there I can see how the token2 comes, and also from the result itself

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 19:40:08 GMT

Splunk Version
6.5.2

Re: Search a yes/no field with a single checkbox token

Vijeta — Tue, 25 Sep 2018 19:53:24 GMT

I am not sure why its not working, you can try to unset the values of token in finalization event of search.
I am using this to view the values of token-

test_db1

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
  <label></label>

  <choice value="YES">On</choice>
  <change>
    <condition match="$checkbox1$==&quot;YES&quot;">
      <eval token="token2">"YES"</eval>
      <!--<unset token="checkbox1"></unset>-->
    </condition>
    <condition>
      <eval token="token2">"*"</eval>
    </condition>
  </change>
  <delimiter> </delimiter>



</input>


<panel>
  <title>"$token2$"</title>
        <search>
    <query>|makeresult|eval a=1|table a</query>
  </search>
</panel>

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 20:03:47 GMT

I pasted the checkbox as from above, it still works in the opposite.

regards
Altin

Re: Search a yes/no field with a single checkbox token

Vijeta — Tue, 25 Sep 2018 20:51:04 GMT

It should not happen that way, did you try clearing the browser cache ?

Re: Search a yes/no field with a single checkbox token

altink — Tue, 25 Sep 2018 21:08:03 GMT

I tried with another browser, still the same result - opposite of what should be.

regards
Altin

Re: Search a yes/no field with a single checkbox token

Dawson014 — Wed, 26 Sep 2018 15:46:48 GMT

Hi,

Have you tried using radiobutton, per you requirement I think the radiobutton is well suited for the job.
By default the radiobutton will be off, and FIELD2=* will work. When you click the on button, FIELD="YES" will be there. Take a look at the code below -

<input type="radio" token="checkbox1" searchWhenChanged="true">
      <label>toggle</label>
      <choice value="YES">On</choice>
      <choice value="*">Off</choice>          
      <prefix>FIELD2="</prefix>
      <default>*</default>
      <suffix>"</suffix>
      <initialValue>*</initialValue>
    </input>

The query will be like

index=your_index $checkbox1$

Here's a screenshot for you reference -

Let me know if this helps.

Re: Search a yes/no field with a single checkbox token

altink — Wed, 26 Sep 2018 18:43:52 GMT

Thank you very much @Dawson014,
but this question was raised for a single Checkbox solution only,
which by sure is no rocket science, but it seems to be painful here in Splunk.

Re: Search a yes/no field with a single checkbox token

Dawson014 — Thu, 27 Sep 2018 09:46:01 GMT

Hi Altin,

Please try out the solution below -

<form>
  <label>splunk.answers tryouts</label>
  <init>
    <set token="search_token">FIELD2="*"</set>
  </init>
  <fieldset submitButton="false" autoRun="true">
    <input type="checkbox" searchWhenChanged="true" token="checkbox1">
      <label>toggle</label>
      <choice value="YES">On</choice>
      <change>
        <condition match="$checkbox1$==&quot;YES&quot;">
          <set token="search_token">FIELD2="*"</set>
        </condition>
        <condition>
          <set token="search_token">FIELD2="YES"</set>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=db $search_token$</query>
          <earliest>-1m</earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

This is working as intended for me.
Just substitute the search query with yours. Let me know if this does not work.